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M&C Folio: GBP29015SY 



Electronic Voting Systems 



This invention is generally concerned with systems and methods' for electronic voting. 

An election poses many challenges for the system used for voting, whether this is a 
manual system, a mechanical one or an electronic one. Traditiorially manual systems 
have "been used and axe still widely used. For some decades mechanical systems have 
been used in some countries* and in recent years electronic voting systems have had 
their breakthrough in a number of countries. Common to all is that very high {Standards 
have to be set on the security of the process of voting, such that voters can be confident 
that the result of the election correctly reflects the votes cast, whereas at the same time 
secrecy of the votes cast shall be ensured. In fact a long list of apparently conflicting 
requirements can be stated. . ' 

Common for the systems used for general elections in a larger scale today is that they 
duplicate the basic principles of the manual election, which we will briefly review. A 
voter enters a voting site, where his identity is checked* after which he receives a ballot 
and enters a voting booth where he can vote in privacy. He then folds his ballot such 
that nobody can see what he has voted, enters the public sphere again and drops his 
ballot into a container. The whole process is monitored by a sufficiently largo and 
diverse group of people such that it can be trusted not to cheat A number of special 
cases may exist in the process. For example the first voter may have the opportunity to 
verify that the container is initially empty and it may be possible to regret the choice in 
the time span between entering the choice on the ballot and dropping it into the 

« 

container. After the election the votes are counted. Throughout the 'whole process it is 
ensured that at every step everything is monitored by a group of people sufficiently 

* 

large and diverse to be trusted, 
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Mechanical and electronic voting systems follow the same principles, In fact it seems 
that the core element in the design of such systems is that the process shall be changed 
as little as possible when introducing a new system. For example DRE (Direct 
Recording Engine) ^voting systems, store individual votes on a memory cam such that 
they can be counted afterwards instead of just keeping track on the statistics to be 
reported. 



However, when using electronic devices a number of properties of the original process 
are altered in disfavour of the security despite that the process is kept fixed, hi particular 
the following properties are always lacking unless great care is taken: 

a) The voter is no longer able to see that what he enters on the machine is actually 
what is recorded. 

b) The officials monitoring the process are no longer able to see that one vote is 
recorded for each voter. 

e) The monitoring of the counting process is no longer efficient since nobody can 
see what really happens during counting. 

This has been known for many years in academic circles and has led to a number of 
initiatives: 

1) Some have hied to inform the public and decision makers about the situation 
and have been driving a debate that has recently been rather heated as DRE 
machines have become more widespread. 
2) Some have developed the technology for dealing with the new challenges posed 
by electronic voting system. This has been done as basic research in universities 
worldwide and in applied research projects like the e-Vote (1ST 2000-29518, 
http://www.instore.gr/evotfl) and Cybervote (IST-1 999-2033S, 

http^/www.eucybervote.org) projects as well as in private high tech companies 
like Cryptoroatfaic. 

For background prior art reference can be made to the following: 

WCtaWdga CaSes \PJM«BP290] 55 Y\CBK»(M # V_S P ^fi«tf w ^ dldlrinBidoc 
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[DOS] Ivan Damgard, Jens Groth, Conn Salomonsen "Hie Theory and Implementation 
of an Electronic Voting System", in Gritzalis, D. (Ed.) Secure -Electronic Voting, 
Kluwer Academic Publisher, Boston, USA, November 2002 0SBN 1-4020-7301-1) 

[DJ01] Ivan Damg&d and Mads Jurik. "A generalisation, a simplification and some 
applications of Pailliers public-key system with applications to electronic voting", In 
Public Key Cryptography 'OU pages 119-136. Springer-Verlag, LNCS 1992, 2001. 

[NEF01] C. Andrew Neff. "A verifiable secret shuffle and its applications to e-voting". 
In proceedings of the 8'th ACM conference on Computer and Communications 
Security, pages 116-125. ACM Press, 2001. 

[NEF03] C. Andrew Neff "Election Confidence". Version 6, December 2003. Preprint 
available o n www.votefaere.not 

[BGRl Mihir Bellare, In an A. Garav and Tal Rabin: "Fast Batch Verification for 
Modular Exponentiation and Digital Signatures", EI TRQCRYPT 1998 , LNCS series 
1403, Springer Verlag., pages 236-250. 

[DF] IvanDamgard and Eiichiro Fuiisaki : "A Statistically-Hiding Integer Commitment 
Scheme Based on Groups with Hidden Order", A ST A CRYPT 2002, LNCS series 2501 , 
Springer Verlag, pages 1 25- 1 42 

[F] Jun Furukawa: "Efficient, Verifiable Shuffle Decryption and Its Requirement of 
Uminkability", Pi.Wtic Kev Crvptosranhv 2004 . LNCS series, Springer Verlag, pages 
319-332. 

[FMMOS] Jun Furukawa, Hfaoahi Mivauchi. Kenao Mori , Satoshi Obana and Kazue 
Sako : "An Implementation of a Universally Verifiable Electronic Voting Scheme based 
on Shuffling", Financial Crvptogranhv 2002 . LNCS series 2357, Springer Verlag, pages 
16-30. 
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[FS] Furukawa and Sake: "An efficient scheme for proving a shuffle", CRYPTO 2001, 
LNCS series 2139, Springer Verlag, pages 36S-3S7. 

[G] Jens Groth: "A Verifiable Secret Shuffle of Homomorphic Encryptions", Public 
Key Crvptogra,phy„2()03» LNCS series 2567, Springer Verlag, pages 145-160 

[GMY] Juan A. Garay, Philip D. Macgen^f. and Ke Yang : "Strengthening Zero- 
Knowledge Protocols Using Signatures", EUR.QCRYPT 2003 LNCS series 2656, 
Springer Verlag, pages 177-194. 

[Npatent] Andrew Neff, VoteHere; "Verifiable secret shuffles of encrypted data, such as 
ElGamal encrypted data for secure multi-authority elections", patent application 2002. 

Further background information useful for understanding the invention can be found in 
"Verifiable e-Voting" by CA, NefF and J. Adler, August 6, 2003. 

Pursuers of 1) require printed ballots to be produced for voters to watch and store the 
traditional way such that they can be used for recounting. The pilot system developed 
and tested in the e-Vote project uses digitally signed, encrypted votes, such that it is 
ensured that there is control of; who cast each individual vote. It also utilizes a secure 
protocol based on homomorphic encryption and zero-knqwledge proofs (see [DCS], 
[DJ01]) to ensure that the counting process is universally verifiable while preserving 
secrecy. Universally verifiable means that it is possible for an independent observer to 
verify that the votes are authentic, correctly formatted and have been counted correctly 
without breaking the secrecy of the election. However, it does not deal directly with the 
issue mentioned in a), that each voter shall be able to verify that his choice is actually 
what is recorded in hi 5 vote. Votes with the e-Vote system are generated and signed in 
an applet on the PC of ifce voter, so a) can be ensured by intercepting the applet and 
verifying that it performs comply (by means of installing third-party software). 
However, this only works for Internet voting and it comes together with the expense 
thatreceipt-fi-eeness is only conditionally possible with Internet voting. 

V:\Cambridge C^es^JM\GBP290l55Y\GBP2901S5Y_S J1 ^fic a tion. aa d.ol a i« s .d oe ' 
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One purpose of embodiments of the present system is to bring together the two 
approaches in a novel way by showing how an e-voting system can be designed with 
existing technology such that 

L The properties of embodiments of the system are such that none of the issues a),, b) 

or c) constitutes a significant security treat 
II. Several counting and recounting procedures are possible with different properties 
with respect to security and cost and where the highest obtainable level of 
integrity of the result of the election is considerably higher than for traditional 
manual elections. 

Thus in a relaxed political climate costs can be saved and final results of the election 
can be made available quickly, whereas in a tense political climate, where current 
manual procedures are insufficient to ensure integrity of elections, the level of security 
can be increased. 

Previous electronic voting systems as described above by Neff et aL provided voters / 
with receipts which they can take away and aft^r polls close use to confirm, for example ; * 
by telephone or the internet, that their ballot was as intended. However such a system. 

> 

can Jack transparency and it is preferable* at least from the point of view of public 
perception* not to depart so far from a conventional paper-based or mamtai voting 
system. Nonetheless manual systems are by no means perfect despite their relative 
transparency and, as described further below, there is scope for corruption which is 
unlikely to be detected without fairly extensive recounts. 

There is therefore a need for electronic voting systems which provide security and 
integrity but which nonetheless will engender public trust. In embodiments of the 
invention described below this is achieved by retaining a printed ballot system which 
works in conjunction with an electronic system to guarantee a high level of integrity and 
security. 

V:\C3Hlbridg6 Cases\i»JM\GBP290i S5Y\GBP290l55Y_Speeifi t »tioH.afld.<il a iTOs.doc 
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According to a first aspect of the present invention there is therefore provided em 
electronic voting system, the system comprising: a voting device configured to generate, 
iti response to a voter selection for each of a plurality of voters an encrypted electronic 
ballot and a printed ballot, "both having voter selection data indicating a said voter's 
choice, said ekctrpnic ballot including information to link it to said printed ballot and 
said printed ballot including information to link it to said electronic ballot; an electronic 
vote decryption system configured to receive electronic ballots from said voting device 
and to decrypt said encrypted electronic ballots including said linking information; and 
a voting verification system configured to receive decrypted voter selection data and 
linking information from said vote decryption system* to receive voter selection data 
and linking information from said printed ballots and to compare voters choices for a 
sample of said printed and electronic ballots linked by said linking information, to 
verify the voting. 

Either the electronic ballots or the printed (paper) ballots may be sampled but it is 
preferable to provide a system which allows printed ballots to be sampled and then 
linked to decrypted electronic ballots to save time in laboriously searching through large 
numbers of printed ballots. This can be facilitated by means of special ballot box which 
is configured to sample the paper ballots and, optionally but preferably, scan the printed 
ballots although in such a way that the sample ballots cannot b$ influenced. 

To facilitate sampling, and then checking, printed ballots rather than electronic 
encrypted ballots preferably the voter verification system is configured to determine that 
all the printed ballots carry different linking information, that each printed ballot links 
to an electronic ballot, and that the number of printed ballots is the same as the number 
of electronic ballots, for example automatically counting the printed ballots. Making 
these checks enables the sampling of printed ballots. 

A printed ballot may comprise, for example, human readable information indicating the 
choice(s) of the voter and Infoiraation linking the printed ballot to an electronic ballot. 
The linking information shall preferably not identify the voter (in order not to break 
secrecy of an election, provided that the election is secret) and it shall preferably be in a 
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difficult-to-read (at least for a human) format such as a bar code and shaft preferably not 
be influenced by the voter (in order to prevent coercion* again provided that the election 
is secret). An example of such information is an identifier of the district followed by a 
large random number selected by the device used for voting at the time of voting, 
printed in a bar-code format on the printed ballot. The linking information may be 
ciyptographically protected, for example by including a MAC (Message Authentication 
Code) or a digital signature in the linking infoitnation. If the IMing information is 
cryptographically protected, the cryptographic protection may also protect the choices 
of the voters (in order to prevent copying of linking information on printed ballots to 
other ballots with different choices of voters). 

An electronic ballot may comprise, for example, voter identification such as the voter's 
name and encrypted information, preferably electronically signed^ this encrypted 
information indicating the voter's choice. The encrypted information may also include 
information lirjMng the electronic ballot to a printed ballot and/or this linking 
information may be provided separately from the encrypted information indicating a 
voter's choice, but if so must be treated similarly to the encrypted information 
indicating the voters choices. As described further Jater, during the counting process the 
electronic ballots are preferably separated from voter identification information so that 
they are depersonalised (though this is not essential, the voting then becoming akin to a 

■ 

show of hands). This de-peraonalisation may be made secure by means of one or more 
electronic shuffles of the electronic ballots, which may be performed in such a way that 
it can be proved that no vote$ have been changed, in preferred embodiments using a so- 
called zero-knowledge proof. In some embodiments each shuffle may also partially 
decrypt the encrypted electronic ballots; new zero-knowledge proofs or such a process 
are described later. With such a system it is also possible to separate the shuffling and 
gradual decryption process from the verification process, which facilitates more rapid 
data processing. 

4 

In another aspect of the invention provides a computer system for verifying an 
electronic voting system, the computer system comprising: data memory operable to 
store data to be processed; program memory storing processor implementable 

V;SCambridge Cas§s\PJM\GB)?2<)0 1 55 Y\GHP290 1 55Y_Spset fi^ion^and.claims.doo 
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instructions; and a processor coupled to said data memory and. to said program memory 
to toad and implement said mstmctJcns, the instructions comprising instructions for 
controlling the processor to: receive decrypted voter selection data and linking 
information from said vote decryption system; receive voter selection data and linking 
information from said printed ballots; and compare voters choices for a sample of said 
pirated and electronic ballots linked by said linking information to verify the voting. 

The invention also provides a device for collecting ballots, the device comprising: a 
ballot input to accept a ballot submitted by a user; a first ballot holder for holding 
ballots for checking; a second ballot holder; and a user interface to allow said user to 
signal to the device an intention to submit said ballot; and a selectot responsive to said 
signal to select substantially at random one of said first and second ballot holders to 
receive said submitted ballot. 

The skilled person will recognise that selection as random does not necessarily imply 
equal numbers of ballots in the first and second ballot holders, The device may fiirther 
include a ballot reader to read linking information on the ballot or local storage and/or 
forwarding over a network. ! 

In another aspect of the invention provides a printed ballot for an electronic voting 
system configured to count electronic ballots corresponding to printed ballots, said 
printed ballot bearing information linking the ballot to a said electronic ballot and 
information to allow a voter to identify one or mote choices, the printed ballot being 
configured or configurable such that said linking infoimation and said choice 
identification information are both visible, but not simultaneously, 

The invention further provides a method of operating an electronic voting system, the 
method comprising: collecting a vote from a voter; outputting vote as both an encrypted 
electronic ballot and a printed ballot, each of said printed and encrypted electronic 
ballots bearing information linking it to the other; displaying the printed ballot to the 
voter; collecting the printed ballot; repeating said collecting, ouiputting, displaying and 
collecting for a plurality of other voters; decrypting and counting said electronic ballots; 

CasesXP JMM3BF290] 55Y\GBP2£0l 55y^Sp«jficstWtt.artd.^inis.doc 
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selecting a sample of said printed or electronic ballots and reading voter choices for said 
sample; reading voter choices for electronic or printed ballots linked to said selected 
ballots by said linking information; and comparing said voter choices read from said 
sample and said linked ballots to verify a result of said voting- 

The invention further provides a method of committing to an electronic data value, the 
method comprising selecting a substantially random number and a sub group of the 
multiplication group Z*^ of integers computed modulo n where n is a product of two 
primes for the electronic data value and/or said substantially random number and 
determining a commitment value from said electronic data value arjd said substantially 
random number using said subgroup. 

The invention further provides a method of providing information for verifying 
correctness of a permutation of encrypted messages performed usi&g one or more data 
processing entities, the method comprising: sending a commitment (c^) to a first set of 
values (t) defining said permutation to a verifier; receiving a second set of values (t) 
from said verifier; permuting said second set of values with said permutation; sending a 
commitment (cj) to said permuted second set of vaLues to said verifier; and sending 
additional informatiotx to said verifier for verifying correctness of said permutation, said 
additional information verifying that said Second set of values was permuted with said 
permutation, Preferably the sending of additional information comprises; receiving a 
pair of challenge values (\ x) from said verifier; detemritling a third set of values (a) 
from said permutation, said second set of values and said pm of challenge values and 
sending a commitment (Cg) to said third set of values to said verifier; deterxnining and 
seeding a commitment (c a ) to a fourth set of random value$ (d) to said verifier; 
determining a fifth set of random values (A) and sending a commitment (c A ) to a 
combination of said fourth and fifth sets of vajues to said verifier; sending a check value 

* 

(E) derived from a further random value (R) to said verifier; receiving a further 
challenge value (e) from said verifier; and sending values (f, z, Z) determined from said 
further challenge value, said pair of challenge values, said further random value, and 
said permutation to $aid verifier- whereby said verifier is able to verify said correctness 
using a sero-lcnowledge protocol. 
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In a related aspect the invention provides a method of providing kifbnnation for 
verifying correctness of a combined permutation and partial decryption of encrypted 
messages performed using one or mors data processing entities, the method comprising: 
sending information to said verifier for Verifying correctness of said combined 
permutation and partial decryption, said information comprising information to enable 
said verifier to verify said performance using a zero-loiowtedge protocol- Preferably the 
information sending comprises: sanding a commitment (c s ) to a first set of values (x) 
defining said permutation to a verifier; receiving a second set of values (t) from said 
verifier; permuting said second set of values with $aid permutation; sending a 
commitment (c t ) to said permuted second set of values to said verifier; receiving a pair 
of challenge values { \ x) from said verifier; determining a third set of values (a) from 
said permutation, said second set of values and said pair of challenge values and 
sending a commitment (c*) to said third set of values to said verifier; detejmining and 
sending a commitment (cd) to a fourth set of random values (dj to Said verifier; sending 
a triplet of check values (D ? U, V) derived from a pair of random values (d, R) to said 
verifier; receiving a further challenge value (e) from said verifier; and sending values <f> 
z 9 Z) determined from said further challenge value, said pair of challenge values, one of 
said pair of random values, and said permutation to said verifier. 

The invention further provides a method of shuffling and decrypt^ encrypted 
electronic data using a plurality of data processing entities,, each entity having a share of 
a secret key, the method comprising, at each of said entities, partially decrypting and re- 
randomising said electronic data using said secret key share such that a final said data 
processing utility fully decrypts said data. 

The invention also provides a method, in a computer system, of providing data for 
verifying that messages of a set of messages provided from a corresponding set of 
entities are authentio 3 flie method comprising: selecting, for each, said entity, first second 
and third random numbers; determining, for each said entity, first and second 
verification values from, respectively, said first and second random numbers and said 
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entity's message, and said first m& third random numbers; and outputting, for each 
entity, said entity's message and said first and second verification values. 

The invention further pt&vides a method for providing data for verification systems for 
verifying that messages m i ? «,m K are authentic using a homomorphic verification 
system without revealing their origin, the method comprising entities fE 5 } producing the 
messages each choosing random numbers e j, ij and pj and submitting m j5 V(e js r£ 
anonymously to one entity (entity A) and V(m j e ^ p ,) to another entity (entity B) 
where V is a verification function, in particular a homomorphic function, in such a way 
thai the messages are authenticated. 

The invention also provides computer program code to implement the above described 
systems and methods. Such code may be provided on a data carrier such as disk, CD- 
or DVD-ROM, programmed memory such as read-only memory (firmware), or on a 
data carrier such as an optical or electrical signal carrier. The code may comprise code 
in any conventional programming language, such as C, As the skilled person will 

appreciate such code maybe distributed between a plurality of coupled components in 

commutiication with one another, for example on a network. 

We further describe a voting system feature comprising: at least one device used for 
voting entering preferably (the same or associated information) on a printed ballot and 
an encrypted electronic ballot linking the two to each other. Preferably each voter is 
allowed to watch the content of the paper ballot to verify that it contains his choices. 
Preferably at least one instance makes available depersonalised clear-text electronic 
ballots with their information linking them to printed ballots to the public or to selected 
entities. Preferably a procedure selects a random sample of electronic ballots and 
verifies that their content corresponds to the content of corresponding paper ballots with 
the purpose of establishing confidence that the electronic ballots have not been 
subjected to large-scale tampering. . 



We further describe a voting system feature comprising: at least one device used for 
voting entering preferably (the same or associated information) on a printed ballot and 

V;\Cambridge CaacsNP JM\GBF2901 55Y\GBP290l55Y_Spccift^tiQn.and^lairns-doc 
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an encrypted electronic ballot linking the two to each other. Preferably each voter is 

allowed to watch the content of the paper ballot to verify that it contains his choices. 

Preferably at least one instance makes available depersonalised clear-text electronic 
ballots with their information linking them to printed ballots to the public or to selected 
entities. Preferably & procedure selects a random sample of electronic ballots and 
verifies that their content corresponds to the content of corresponding paper ballots widi 
the purpose of establishing a deterrent against tampering with the voting device in 

individual election districts. 



We further describe a device for collecting ballots comprising: two or more containers 
for collecting filled ballots and a user interface allowing a voter to make aware of his 
intention to submit his ballot arranged in such a way that it is decided at random at the 
time of ballot submission whether ballots shall be checked. This works in the way that it 
is by mechanical means ensured that ballots selected for cheeking at random are entered 
in a particular subset of containers. 

We farther describe a protocol for producing a zero-knowledge proof of a correctly 
performed combination of petmuting and partial decryption of homomorphically 
encrypted messages, and the non-interactive versions of the protocol obtained by using 
the Fiat-Shamir heuristic, 



We further describe a homomorphic commitment system that performs efficiently by 
making use of subgroups of for the message space and/or the randomization space. 

We further describe a protocol comprising! use of a homomoiphic verification system 
for verifying the correctness of the result of repeatedly permuting and re-encrypting aad 
finally decrypting homomorphically encrypted content. 

We further describe a protocol comprising: use of a homomoiphic verification system 
for verifying the correctness of the write-in votes obtained by repeatedly permuting and 
re-encrypting and finally decrypting homomorphically encrypted vote$ T 
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We further describe a protocol comprising: use of a homomoiphic verification, system 
for verifying the correctness of the information linking electronic and printed ballots 
obtained by repeatedly permuting and re-encrypting and finally decrypting 
bomomorphieally encrypted votes. 

Aspects of the invention provide data processing apparatus and computer program code 
(which may be distributed over a network), in particular on a carrier, to implement the 
above described system and protocols. 

Embodiments offer faster counting, cost savings and increased service to voters 
compared to manual elections, but with a higher level of security. Aspects of the 
invention can be used in many embodiments: There are many technologies available for 
dealing with the above described issues. In particular all of the technologies 
"homomorphic encryption", "MIX nets" and "digital signatures" can be replaced by 
other technologies in embodiments described later and still provide working systems. 

These and other aspects of the present invention will now be further described by way 
of example only with reference to the accompanying figures in which: 

Figure 1 show and example of a MIX net; 

* 

Figure 2 shows a first embodiment of an electronic voting system according to w aspect 
of the present invention; 

Figure 3 shows a second embodiment of an electronic voting system according to an 
aspect of the present invention; 

Figure 4 shows a first embodiment of a device for collecting ballots according to 
another aspect of the present invention; 

4 

Figure 5 shows a second embodiment of a device for collecting ballots according to 
another aspect of the present invention; and 
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Figure 6 shows a printed ballot suitable far use with the ballot collecting devices of 
Figures 4 and 5; 

Figure 7 illustrates the information that can be contained in a paper ballot and in the 
corresponding electronic vote; 

Figure 8 illustrates how encrypted content may be homomorpbically counted on 
encrypted form to deliver an encrypted result in a homomorphic count; and 

* 

Figure 9 illustrates how a shuffle changes the encryption and the Ordering of electronic 
votes and produces a sero-knowledge proof. 

When we discuss technologies suitable for protecting elections it will "be technologies 
that base their trust on mathematics and suitably composed groups of people being 
unable to cooperate to cheat rather than in elements like trust in the quality of code or 
ability to keep out intruders completely. For example a digital signature cannot be 
forged by malicious software that has access to data that cm be signed unless this 
software also ha$ access to a particular private key. This is contrary to other sorts of 
protection, like a log on a local machine that can normally easily be forged by malicious 

* 

software. Thus fhe protection we discuss is protection against adversaries with access to 
modifying any part of the software they like with very few exceptions (software for key 
generation is an example). When we state that a device must be trusted to do or not to 

do something, we mean that we rely on that the software and hardware of the device 

ensures that the device has the intended behaviour. 

The level of security for the devices used for casting votes, we are aiming at is; The 
devices will be trusted not to give away the choices of individual voters in any other 
ways than the ones specified* However, we will assume that relevant adversaries have 
access to rnodiiying the software and hardware of the devices whenever we discuss the 
highest levels of security supported for protecting against tampering with the choices of 
the voters. 
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This is consistent with the fact that the latter type of attack has the highest potential for 
producing benefits for adversaries, and with that also manual voting allows some 
attacks, like the use of hidden cameras or comparison of fingerprints on voter cards and 
ballots, for breaking the secrecy. 

Two technologies for counting secret encrypted and signed votes (the list is not 
exhaustive, the ones mentioned are the ones we are particularly interested in making use 
of in our invention) are; 

Homomorphic encryption and zero-knowledge proofs combined with a secret 
sharing mechanism. The vote is encrypted and a zero-knowledge proof is 
attached proving that the encrypted vote is an encryption of a correct or true 
vote. Because the crypto system is homomorphic the votes with correct zero- 
knowledge proofs can be counted on encrypted form without ever decrypting a 
vote. Finally, the key for decrypting the result is secret shared between a 
sufficiently large and diverse gtoup of people such that it can be trusted not to 
decrypt individual votes. 

MIX nets. A number of servers (shuffles) one after another re-encrypts 
encrypted votes without being able to decrypt them and passes them on in a 
different, random order together with a zero-knowledge proof that only the order 
but not the content of the encrypted votes has been modified. If several shuffles 
axe used one after another and are operated by different organisations with 
conflicting interests, it is trusted that the association between the original 
ordering of the votes and the new ordering of differently encrypted votes has 
been lost. Further, the zero-knowledge proofs ensure that the content of the 
votes has not been altered. Again a secret sharing mechanism can be used for 
decryption. 

Common to the two approaches is that they employ zero-knowledge proofs and 
particular protocols. Until recently protocols of this type were too slow to be applied in 
practice, but we have developed an efficient homomorphic encryption protocol and an 
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efficient MIX net protocol. Both can be implemented over the same homomorphic 
crypto system. 

We have recognised that the two technologies have different properties; Counting 
including verification can be parallelised arbitrarily for homomorphic encryption, so it 
scales well and can produce a fast result. Further it is easy to trace back incorrectly 
formatted electronic votes to their origin with this technology {this should never happen 
unless machines used for voting are malfunctioning or tampered with - instead there 
should be a correctly formatted invalid choice). The disadvantage is that a special zero- 
knowledge proof must be designed for each voting rule, (A voting rule can for example 
be* that each voter can select one option, vote blank or provide an invalid vote, Another 
voting rule can be, as used in practice in Greece, that each voter may vote for up to five 
persons from the same political party or provide an invalid vote, These two rules require 
different zero-knowledge proofs since different properties of the content of encrypted 
votes mu$t be proven.) MIX nets are more flexible when it comes to implementing 
different voting protocols because the same zero-knowledge proofs can be used for all 
voting rules. 

In one of the proposed embodiments of our invention we will combine both 
technologies in order to get the best properties from both. 

The technologies discussed are sufficient to deal with the issues b) and c) mentioned in 
the introduction, so it remains to di$cuss the issue a). By having ballots printed voters 
are provided with the service that they can see what they have voted on paper, and they 
have tlie same level of certainty as at a manual election, that their vote will count* 
provided that a manual recount actually takes place, The idea, as already hinted, 
however has a number of shortcomings in its pure form: Almost rio information is 

* 

gained by checking a few votes in a district. The only action that makes sense is to 
make total recounts in a selection of districts. However, if let' s say a manual recount 
tafces place in 10% of the districts^ this gives a 10% chance of being taken for somebody 
manipulating votes in a particular district for a particular election. This may well be a 
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chance worth taking for a politician facing a rained carrier if he looses. The same can be 
said for a 30% or a 50% chance. 

Consequently quite comprehensive recounting i$ necessary in order to ensure that the 
mechanism works as intended - not only by revealing attempted fraud, but also by 
preventing attempts of fiaud from happening by acting as a deterrent. Embodiments of 
an aspect of our invention have the following properties: Electronic votes contain 
encrypted infoimation identifying the manual vote and preferably the election district. 
The electronic votes can be detached from the identity of the voter by means of a MIX 
net or a similar mechanism in a secure way; after being detached from the identities of 
the voters, they are decrypted. We can pick a tandom sample of all the electronic votes 
of an arbitrary size. 

We now comment on references to "depersonalisatioiT. A practical system will 
normally be required to log information about significant actions. In particular temporal 
information linking specific events to the time they happened is usually logged. For 
example the Signer (see later, with reference to WO 03/015370) used in embodiments 
logs the hash value of the information signed together with the time of signature (in 
embodiments this means that double-voting using the same credentials is logged, which 
is important for providing accountability). Also the underlying mftastructure, in 
particular firewalls and Internet operators, may log parts of the network traffic, as may a 
man-in-the-middle. Combining the time an individual voter votes together with the time 
particular electronic votes (or bash values of electronic votes) were handled by a 
component of the system, breaks the secrecy and opens up the possibility of coercion. It 
is therefore preferable to always consider an electronic vote to be linked to the identity 
of the voter until it is de-linked from the identity of the voter by a cryptographically 
sound protocol. We prefer to make it explicit that identities of voters are linked to 
electronic votes by having the identities linked to the electronic votes in a 
cryptographically protected way, which in the embodiments provided is done by having 
a voter signature on each electronic ballot. This feature is however not essential to 
aspects of the invention. Providing a cryptograpbicaUy protected identity of individual 
voters together with the electronic votes means that accountability of, where individual 
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encrypted electronic votes originate from is provided, such that identities of voters 
whose votes were counted is part of the information that is universally verifiable. 

Say that we want to ensure with 99% probability that at most 1% of the electronic votes 
are tampered with* i.e. contain different choices than the ones entered by the voters. 
Then we pick 459 random electronic votes. For each of those, if at least 1% of the 
electronic votes contain different choices than the corresponding manual votes, it has 
less than a 99% chance of passing the teat of being compared to the corresponding 
manual vote. Consequently there is a probability of less than 0.99 459 - 0,009921 feat all 
of them pass the test 

It is clear that letting electronic ballots identify non-existing printed ballots will be 
discovered- However, letting more electronic ballots identify the same printed ballot is a 
possible attack unless care is taken. The procedure that must be carded out in the 
individual districts is therefore to run through all printed ballots in the district to 
establish that there is exactly one printed ballot with the same identification as the 
electronic ballot and that the choices on the printed ballot are the same as on the 
electronic one. 

For the ultimate case, a general election in the US say, it means thai by manipulating 
459 votes out of maybe 100.000,000 or even 200.000,000 and causing the rather simple 
procedure to happen in 459 randomly chosen election districts, you actually get quite 
confident that no large scale fraud takes place with the electronic votes. And this is by 
carrying out a procedure simpler than counting manually in less than 10 election 
districts in each state in average. 

In an aspect of the invention we let each encrypted vote carry information linking it to 
an individual ballot. After detaching the votes from the identities of the voters, take a 
sample of random decrypted electronic votes and compare them to the corresponding 
rnanual votes (using the linMng informatioii) in order to create confidence in the 
accuracy of the result of the election with relatively little effort. 
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Additional information on an electronic ballot can be used for coercion by entities wife 
access to decrypted, depersonalised electronic ballots. Therefore the information should 
be represented on the printed ballot in a form difficult to manage by voters (not easier to 
copy than taking a photo of the ballot or essential parts of the ballot) and the voter 
should preferably not be able to influence the information. One possibility is to use 
random data represented as bar codes on the printed ballots. 

The way statistics behave whoa doing different kinds of checking follows from 
elementary mathematics. The low efficiency of the standard scheme of producing 
manual ballots without any other option than doing full recounts for election sites or 
election districts was also noticed in [NEF03] but in this document using printed ballots 
was seen as opposed to using testing based on providing voters with receipts, which 

* 

they may have difficulties with handling and understanding and lacks transparency 
compared with a printed ballot. 

This scheme can also be carried out the other way around, in that paper ballots are 
picked and compared to anonymised electronic ballots. This has the advantage that less 
manual work is required. We propose the following scheme: the paper ballots are 
counted, the number is compared to the number of electronic ballots from the district. 
Then some paper ballots are picked at random and it is verified that they correspond to 
electronic ballots and have the same content, If the number of paper ballots and 
electronic ballots are not the same, the paper ballots are counted. The property we are 
aiming at using is that if there is the same number of electronic and paper ballots, and a 
certain number of electronic ballots do not correspond to paper ballots, then the same 
number of paper ballots do not correspond to electronic ballots. Thus, if we know that 
the information linking paper ballots to electronic are different and the number of paper 
ballots correspond to the number of electronic ballots, it is just as efficient to pick 
random paper ballots. In embodiments this is ensured by scanning the linking 
information on each paper ballot and let the system verify that all of these properties are 
satisfied. We are of course aware that it may be a very time consuming and complex 
task to carry out this comparison manually. If a single entity is not trusted to verify that 
these properties are satisfied alone, we suggest that a protocol is used between the entity 
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responsible for handling results of scanning the paper votes and. the entity responsible 
for. storing depersonalised decrypted electronic votes that ensures that both do the 
verification- (Example: The entity responsible for handling results of scanning the paper 
votes submits the result of each the scannings signed by a private key, awaits a yes/no 
answer about whether the information matches the information on an electronic ballot 
and processes the information. The entity storing the depersonalised decrypted 
electronic votes performs the verification and returns yes/no about whether the 
information matches the information on an electronic vote, also processes the 
information, and finally submits the signed result of the scanning for universal 
verification.). 

The procedure described above is efficient for revealing large-scale fraud. However, it 
still suffers from the deficit that it does not efficiently act as a deterrent against fraud in 
individual districts. Before we proceed with describing how to install such a deterrent, 
we will notice the difference between the requirement for having confidence in the 

■ 

overall accuracy of a country-wide election and the requirement far having a deterrent. 

The first needs to be established quiddy such that the result of the election can take 

effect, For the latter to work, it a$ however enough that fraud is detected with a high 

probability inside a reasonable time window, for example a few months. That means 

that costs can be kept down when repeating the procedure in individual districts by 

having few MIX net servers (and corresponding high-security facilities and staff) doing 

the electronic parts, and by giving districts reasonable deadlines for answering results 

such that they can organise their work efficiently. It also has the advantage that the 

capability of decrypting votes does not have to be distributed or* too many facilities and 
persons. 

We give an example of how an embodiment of another claim of our invention can act as 
an efficient deterrent. 

Say we carry out the procedure described above with 194 randomly chosen votes in 
each district Then in each district somebody manipulating 2% of the votes will face a 
98% chance that the fraud is detected. {Probabilities are estimated under the assumption 
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that there are much more than 194 votes. Lower number of votes in all cases give higher 
probability of detection.) If he manipulates 1% of the votes he will face an S6% chance 
that it is detected and if he manipulates 0.5% of the votes he will face a 62% chance that 
it is detected. If he manipulates 0.1% of the votes* he will face a 17% chance that it is 
detected, which is not much, but on the other hand his chances of influencing the 
outcome of the election by changing 0,1% of the votes are probably also not good. If 
fraud is detected in this way, a manual recount and a police investigation can be 

initiated such mat the result of the election can be corrected and such that apparently 

fraudulent candidates and their assistants can be tried in court. 

The number of votes checked and the procedure that takes place in case that fraud is 
detected can of course be tuned according to needs. 

In another aspect of the invention we use information in each encrypted vote linking it 
to an individual ballot. After detaching the votes from the identities of the voters, take a 
sample of random decrypted electronic votes and compare them to the corresponding 
manual votes in order to install an effective deterrent against fraud with the election. 

We must expect that both the procedure for creating confidence in the result of the 
election and the deterrent will be used together, Further, this should be done in a manner 
as efficient as possible. We describe a procedure below: 



At each election site/district there is a PC with a scanner capable of reading the 
information on the paper ballots linking them to electronic ballots, but not 
necessarily capable of reading what is voted for. The PC is on-line, is running a 
special application and has access to the electronic anonymised votes. 
The paper ballots are scanned and a program on the PC verifies that all the 
ballots carry different information, that the information corresponds to 
information on an electronic vote and that the number of paper votes is the same 
as the number of electronic votes. 

* 

A sample of (about 194) randomly chosen votes is collected, For each of those 
it is verified that the electronic vote corresponds to th<? paper vote. 
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We now outline public key cryptosystems. 

A public key cryptosystem generally consists of three algorithms E, and D, 

• K in the key generation algorithm and produces a public key> pic; and a secret 
key, sk. 

• E is the encryption algorithm. It takes as input the public key pk and a message 
m. It produces a ciphertext c E P k(m). 

The algorithm may be randomised; it generates some random bhs and uses them 
in the encryption process. When emphasizing these random bits, we write them 
as an explicit extra input to the encryption algorithm, i.e., c = Ep fc (m;r), 

• D is the decryption algorithm. It takes as input the secret key sk and a ciphertext 
c. Using this it produces m = Bpis(c), 

One particular group of public key cryptosystems is ElGamal- style cryptosystems. 

Consider the group Zp\ Le«* the multiplicative group of integers modulo p 5 where p is a 
prime. Let q be a prime, such that q divides p- 1 « Then there is a cyclic subgroup G q of 
Zp* with order q. Let g be a generator for this group, i.e., <g> - G q - 
The key generation algorithm picks primes q, p and a generator g as described above. It 
selects at random an element x € Zq and computes h = g x mod p. It outputs public key 
pk - (q,p,gji) and secret key sk = x. 

To encrypt a message m e G q the encryption algorithm picks a random r e and 
returns ciphertext c = (u ? v) « Epk(m;r) ^ mod p, h T m mod p), 

» 

The decryption algorithm on a ciphertext c = (u ? v) returns m = D&(c) - vu x mod p. 

Another variant of the ElGamal eryptosystem uses the group Z^, where n = pq, and p>q 
are large primes. The multiplicative group 2^2* of elements computed modulo n 2 has 
order n*Iom(p-l 9 q-l ), and the element has order n in Zj** 
Here the key generation algorithm outputs two elements g ? h of ordex lcmfr-^q-l), i.e., 
pk = (n,g 3 h) and the secret key is sk = x 5 such that h - g x mod n 2 . 
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To encrypt a message m e the encryption algorithm picks a random r and computes 
ciphertext c = E pk (ni;r) = (g T mod n 2 , b r (l+n) m mod n 2 ). 

On ciphertext c = (u,v) the decryption algorithm outputs to = D sU (c) - ((vu x mod n 2 ) - 
l)/n. 

Please note that ElGamal cryptosystems are examples of homomorphie systems, i.e., 
E p x(nii4in 2 ;r 1 +r 2 ) = EpkCmtjr,) * Epu(m 3 ;r 3 ). For another type of homomorphie 
cryptosystem see for instance [DJ01]. 

Common for ElGamal-style cryptosystems is that we can secret share the secret key. 
This means that we can have several parties that each get a share of the secret key, and 
only by cooperating can they perform the decryption operation. This is important in 
voting, where we want to have strong security guarantees that no single party is capable 
of decrypting a ciphertext containing a voter's vote. 

There are several methods for doing this secret sharing; here we focus only on a simple 
linear method. Let the secret key be x. We pick at random si,. , such that x = s, +. . .+ 
$ k . Give each party Si, . . -,S K the secret share s 5 . . . -,s fc , they now have a sharing of the 
secret key, but no proper subset of the parties can compute the secret key. 

As a step in decrypting the ciphertext c = (u»v) we want to compute U x (we will from 
now on not be explicit about the group we are working in, it can be modulo p, modulo 
n 2 , or a completely different type of group, for instance one based on elliptic curves). 
The parties Si,.. .A can cooperatively do so. They simply compute m = u**,.. .,u k - u , 
and publish their decryption shares. Now, anybody can compute vu" x = v(u,*, . ,*u k ) -1 , 
and from that extract the message. 

There is a problem though. Imagine a party Si cheats and supplies an incorrect 
decryption share, m that case* we may end up with believing that the plaintext is 
something completely different from the message that was actually encrypted. 
To solve this we let the key generation algorithm compute verification keys hi = 
g 81 ,. . .,hK - g* k , and output these together with the public key. We now demand that each 
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server S\ makes a zero-knowledge proof that U; has been computed with the same 
exponent s\ as has been used to compute hi. We will explain the notion of zero- 
knowledge proofs later, for now let lis say that it proves the correct use of exponent 
without revealing anything about $ . 



We now describe commitments. 



In an example of a bit commitment protocol Alice chooses a bit and sends proof to Bob 
although, due to the character of the proof, Bob cannot tell what Alice's bit is until she 
tells him. Once she does> Bob can easily verify that she is telling the truth; a simple 
case is a piece of paper in a locked box, 

r 

A commitment scheme generally consists of three algorithms K, C 3 and V. 

* K is a key generation algorithm that outputs a public key pk* 

* C i$ a commitment algorithm. It takes as input the public key pk and a message 
m. It outputs a commitment c <- Cpk(m). C is a randomized algorithm, and when 
needed we write the random bits used as i t and have c = C P k(m;r), 

* V is a verification algorithm that outputs accept or reject It takes as input a 
public key pk ? a commitment an opening (m,r). It outputs accept if and only if 

For the algorithms EL, C, V to constitute a commitment scheme, we require that the 
commitment is hiding and binding* 

Hiding means that from a coj^mitment c it must be infea&ible to tell which message m is 
inside it. Hiding comes in two flavors, computational hiding and the stronger statistical 
hiding. A commitment is statistically hiding, when even given infinite computing power 
it is still impossible to tell anything about the message inside the commitment. 
Binding means that it is impossible to find a commitment c and two different openings 
(mm) and (mj^o) such that the verification algorithm will accept both openings. Also 
the binding property comes in two flavors, computational and statistical A commitment 
is statistically binding if even with infinite computing power it is impossible to form a 
commitment o that can be opened in two different ways. 
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From the cryptographic literatim? a commitment cannot both be statistically hiding and 
statistically binding at the same time. It is possible to have commitments that are 
statistically binding and computationally hiding, and in fact, the ElGamal cryptosystems 
mentioned above are examples of such commitments. In the foUowing, we present three 
examples of the opposite case, namely statistically hiding and computationally binding 
commitments. 

Consider again the group Z?\ and the cyclic subgroup G q of order q. Let g y h be two 
randomly chosen generators for this group, i.e., <g> - <h> » G„. H» public key output 
by the key generation algorithm is pk =■ (q,p,gji). 

To commit to a message iaeZ,we pick at random r e 25» and let the commitment be c 
- g r h™ mod p, 

An opening of the commitment c consists of {m,r), and V outputs accept if and only if m 
e Z^, r s Zq, and c = gti" mod p. 

Another example of a commitment scheme is the following integer commitment 
scheme. We use the group where n - pq is a product of two primes, such that p-1 
and q-1 do not have any small odd divisors. The key generation algorithm picks two 
squares g ? h in 2* at random. 

To commit to an integer m, select r as a random 2|n|-bit number, where \n\ denotes the 
number of bits in n, and compute the commitment o = C P k(m;r) = gV niod il 

An opening of the commitment consists of Cb,m,r) such that b is a square root of 1, and 

c = bgfh™ mod n- 

An important property of the above examples of commitment schemes is that they are 
homomoxphic. Le- 3 CpicCmi+ma;^^) ~ CpkOtti^i) * Cpk(nte;r 2 ). 



We can easily extend the commitments to commit to several values at once. Let the 
public key consist of gjhi,.. .,h rt . Then we can commit to mi m n as c = gh\ ...h„ 
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In an aspect of the invention we describe the following variation- of an integer 
commitment scheme. 

Let n - pq be the product of two primes p and q. Let furthermore, p%q 5 bo two primes 
dividing respectively p-1 and q-1. Reasonable sizes are |p|=[q|=512 bits, where |pj 
denotes the number of bits in p ? and |p*Hq' 1=128 bits. Both p,q,p ? and q 5 must be kept 
secret. Let furthermore, t be an integer such that t > |p*i+|cf !• For instance we could with 
the above parameters select t = 300. 

Pick at random g^h such that <g>=<h> are groups of order p'q 5 . 
The key generation algorithm outputs the public key pk = (n»gjh,t). 

To commit to an integer m, pick at random r as a t-bit number. Compute the 
commitment c = Cp^rn^r) ~ gV mod n. 

To open the commitment reveal the opening (m s r). The verification algorithm on 
opening (m,r) checks that c - gV" mod n. 

Variations of the scheme: 

As mentioned before it is possible to make a variation of the integer commitment 
scheme th^t allows for commitment to multiple integers at once. • 
One can select p\q 3 such that they are composite?. It is important, however, that they 
are selected such that it is hard to guess a number N such that p'fN or q ? pSL 

* 

Note feat we dehberately work in a moderately small subgroup of Z* in order to gain 
better efficiency. This has potential use in both voting protocols and many other 
cryptographic protocols. 

We now describe zero-knowledge proofs 

For example to prove a statement such as T know a modular square root" the prover can 
give the square root to the verifier or provide a so-called zero-knowledge proof to 
convince the verifier that the statement is true without providing any information on the 
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proof aad thus keeping the square root secret. A zero-knowledge proof or zero- 
knowledge argument comprises an interactive protocol to be run between two parties (or 
in some cases mote parties). We call them respectively the prover and the verifier. Both 
of them know some common input and now the prover wants to convince the verifier 
that x has some particular property, for instance that there exists a witness w such that 
few) belongs to some NP-language. To do so, they exchange messages according to the 
zero-knowledge protocol, and in the end, the verifier decides whether to accept or rqect 
tile statement. 

We generally call such an interactive protocol a zero-knowledge argument if it has the 
following three properties 

• Completeness: If the prover knows a witness w for the property of x, then he can 
make an honest verifier accept. 

• Soundness: If the statement is false, i.e., no such w exists; any (possibly 
cheating) prover cannot make an honest verifier accept. 

• Zero-knowledge: Any (possibly cheating) Verifier does Hot learn anything but 
the veracity cf the statement from interacting with an honest prover. 

There are many variations of how to define zero-knowledge proofs and arguments. 

Among them are non-interactive variants, where we instead assume a common 
reference string, chosen with some particular distribution, is available to both prover 
and verifier. Non-interaetive zero-knowledge proofs and arguments are publicly 
verifiable. 

Another variation is honest verifier zerg-knowledge s where the zero-knowledge 
property holds if the verifier follows the protocol, but may not hold if the verifier 
deviates from the protocol. A stronger version of this is special honest verifier zero- 
knowledge, where the verifier's messages are public coin (Le„ consists of uniformly 
random bits) and where it is possible to simulate the entire proof (without knowledge of 
the witness w) if we ar-e given in advance the messages (challenges) that the verifier 
sends. 

Vs^aBobrKfec Cases\PJM\GBP290 1 55Y\GBP290155 Y__gpccificaiioxi.and.olaims.doo 
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A popular method £ot maJdng a special honest verifier zero-knowledge proof non- 
interactive is the Fiat-Shamir heuristic. In the Fiat-Shamir heuristic, we compute the 
challenges as suitable hash-values. This means that we do not need a verifier to choose 
the challenges. Broadly speaking, in the so-called random oracle model, hash values of 
messages are considered to be uniformly distributed random numbers picked the first 
time a hash of a given message is computed. Since randomness of considerable size is 

« 

contained in the relevant encryptions and commitments, messages sent from prover to 
verifier can be considered to be new each time and their hash values are thus uniformly 
distributed random numbers in the random oracle modeL Since also challenges are 
uniformly distributed random numbers, the hash values can be used as challenges 
provided that the output from the hash function has the same size as the challenges. The 
non-interactive proof is thus as secure a$ the interactive protocol in the random oracle 
model. 

Suppose we have a bunch of (homomorpbic) cipherrtexts $ x Ep^mi),. ,. 5 e n <- Ep^niti), 
We want to create another set of cipbertexts containing the messages , but in a 
random order. 

A group of servers Si, - - « 3 St cooperating to do so is called a mix-net Using 
homomorphic encryption, we can construct a mix-net in a simple manner. 

> 

Server Si re-randomises the ciphertexts and outputs them in a permuted order. I.e. 3 Sj . 
selects a permutation ^ randomises R ly . . ,,R rt and outputs Ei^(i}Epi<;(0;Ri),. . 
(En^cn^^Q Here is the index that the i'th index is permuted into by % w 

Call the outputs from the previous shuffle e^^e^ Server S 2 selects another 
peomutation is, other xandomisers Rt,. . ^Rn and outputs Ei^^^Ep^COjRO^ - 
(E n =e 7C (n)E p } t (0;Rn)^ The following servers rerandomise and permute in a similar fashion. 

When the last server Sic has performed a shuffle, then Bi a . . . JEa contain a permutation of 
More precisely, if we call the permutations selected by Si,. . M Sk for m 9 . . .,7E fa 
and 1st - iti(. . .(7t K (») . . then we have B x contains m^i),. . . ? En contains m*< n > 

V:KMbn\dgeCasesW 
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♦ ■ 

However, ouly if all servers cooperate will they know % and be able to litifc messages to 
their ciphertexts, Conversely, if just a single server i$ housst, then the permutation is 
secret. 

Mix-nets are useful in anonymization protocols since they allow obfuscation of the 
relationship between sender and ciphertext. One example area where they are useful is 
in the area of electronic voting where the connection between a vpter and his vote must 
be secret. 

We next describe shuffle verification. 

A problem in the above mix-net is bow to avoid that one of the servers replaces 
ciphertexts with encryptions of other messages. A solution to this problem is to let each 
server make a zero-knowledge argument of correctness of the shufile-and-decrypt 
operation, it performs, 

Le., call the input ciphertexts ei a . . .js* and the output ciphertexts Ei,. ..,En- 

The prover has private input Jt,Rj s . . such that Ei-^jBCO^Ki).. Ea^^EptCQ&O. 

An aspect of the invention provides the following method to demonstrate that indeed 
©i,.. .,e tl ,Ei ? . ..jEn are on the form described above, without revesting Ri a . . .JR* 

We use additional "public" data in form of a public key for a commitment scheme. We 
omit explicitly writing the public fceys, and simply write respectively mconi. 
Multi-commitment mcom is used for committing to multiple messages at once, in our 
case n messages. Furthermore, it has a homomorphic property. Le., 
mcom(mi+Mu... 3 m t i+M T1 ;r+R) = mcQm(mu...,m fl ;r) * mcomfMi^w.MnJR). 

The idea is now to commit to the permutation n in the first step. Receive challenges 
ti,. . . & and commit to them in the same permuted order in the third step. In the last four 
rounds we then prove that we have indeed permuted them in the same way. 
Furthermore, ia the last rounds we show that e } k +\ „ m** \ « Ei x * (l >" JS^ mn ^y 
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The protocol proceeds in 7 steps: 

Common input: e b . . ..eJB,,.. . A ^ ptlblic keys 

S^Kf 1 A ^^S 1 1 6 randomi ^ ■ - A 

•bi e ^O)E(0 ; Ri) > ...,E n =e J[t!l) E pk (0;R n ). ' 5 

1 . Proven Pick r 5 at random and set c^com^Cl), ^ n v r ^ 
Send c g to the verifier. ^^--WJ. 

2. Veririer: Kclc t t t n at random and send them to the prover 

™^«r: Select r t at random and set crranrftm t,^ " 

. Send ct to the verifier. ""^^-.W^ 

4. Verifier: Pick ^ at random and send them to the prover 

Select d, d,, at random. Select r, at random and set c d =meom(d, -r ^ 

Select R at random. Set IWWPfljJB,', .„ En d n "°«**.. • ■ A^O- 

Selects at random and set c A «mcomM 2 Ai -dT^ST ^-KW 
Send c a)Cd ,c As E to the verifier " " VliTA) " 

6. Verifier: Pick e at random and send it to the prover 

t^ n3 -x>A n _ I -a„„,d n )-^_ 1 d n andz A =er a +f i 
Senff R " e ^ I)+ • «R n . 

VerMcation: I,Za ' Z t0 Verifxer " 

Check that mcom(f, r . . . jfcs^vfotfVa. 
Check that mcomfo, , . . . ^ 

Define F t ,F 2t ...,F n as the elements such that 

F l -f 1 - es>e F 2 =F 1 C^ex)-ff 4I ,... je F„=F n _ I (f^ es )+f; in _ I . Verify that F *=eT7 "fu« . 

above is seven move public coin, complete, sound and honest verifier 
aero-knowledge proof of a correct shuffle. 

Efficient ^-knowledge pn> ofs for proving correctness of a shuffle exist 

CFS,G,NEF01 Jsrpatent]. Embodiments of our oronosed 

. , 1 our P r °P° se d shuffle proof are more efficient 

titan previous zero-kaowkdge proofs. 
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We now describe decrypting mix-nets embodying aspects of fche present invention. We 
now assume that the cryptosystem is m ElGarnal-$ty)e cryptosystem. 

Suppose we have a bunch of ciphertexts e t - (u, ,v t ) = Ep fc (:mi V . - (u^Vn) = E^nO. 
We want to learn the messages m^: . .,m^ but in a random order, we do not want 
anybody to be able to link messages and ciphertexts. 

A group of servers cooperating to do so is called a decrypting mix-net. Using ElGamaJ- 
atyle encryption, we can construct a decrypting mix-net in a simple imtttier, Using the 
secret sharing described before the servers $ u t , „S fe each have a share Si,...,flk of the 
secret key such that s » 5]-K . H-Sk* 

Server Si peels off the layer of encryption corresponding to its own secret share, it re- 
randomises the ciphertexts and outputs them in a permuted order. I.e., Si selects a 
permutation n 9 randomises Rb-.^R* and outputs (Ui=g Rl u n(J)> (ha*.. .*h k ) BJ v^) 
u^j^ 1 ),..., (U„= g % ffWj V^(h 2 *..*h^\ m H^7c(i) is the index that the 

i*th index is permuted into by m 

Server S 2 peels off another layer of the encryption correspondingto its secret share. Le., 
if we call the output from St (u^vi),. . . .(Un/v,,), then it selects a permutation tc, 
randomness R u . . .,R n and outputs (U^u^ V,- (h 3 *. . ^(i)"* 1 ),. .., 

(Un-g^u^ V n = {h 3 *. . •*ihfc) Rn v^) ^(n) - *"). The following servers perform similar 
shuffle-and-decrypt operations. 

When the last server S fc peels off a layer of the encryption, then V u . . .,V n constitute a 

* * 

permutation of m u . , „m n , More precisely, if we call the permutations selected by 

Si,. . . a S k for wi,. and let ?t{» = ^0 . .foC*). . ,)» then we have Vi«m«( J)9 . . .>V n =m <Tl y. 

However* only if all servers cooperate will they know « and be able to link messages to 

their ciphertexts. Conversely, if just a single server is honest then the permutation, is 
secret, 

V:\Cam&ri<3g6 C^es\PJMV<^ 
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Decrypting mix-nets are useful for voting, since they allow encrypted votes to be 
decrypted and permuted. This way votes can be counted, bat at the same time, nobody 
can link voters with their votes. Another use could be anonymous publication of 
messages. 

We next describe shuffle-and-decrypt verification. 

A problem in the above decrypting mix-net is how to avoid that one of the servers 
replaces encrypted messages with ciphertexts containing other messages. One possible 
solution to this problem, is to let each server make a zero4cnowledge argument of 
correctness of the shuffie-and-decrypt operation it performs. 

Le, ? call the input (u^vi),.. . ? {u n? v n ) and the output (Ui a Y|)^.„(U^Vji)- Frarthexraore, let 
G ? h and H be public. 

The prover has private input nJEL u - - ^ and s, such that h = G s and (Ui=G R1 u*o> Vi= 

We think of h as the verification key for the prover that performs the shuffle, and H as 
the product of the verification keys for all the remaining servers. In the shuffle the 
server then transforms ElGamal-style encryptions under key (G 3 hH) into ElGamal-style 
encryptions under key (G 5 H). 

An aspect of the invention provides the following method to demonstrate that indeed 

(uuvi)^ t ..(Uo.v^^ipVi),- - t ,(U to Vn>» G^H is on the form described above, without 
revealing Ri ? . . , JR. n and s, 

We need additional public data in form of a public key for a commitment scheme. We 
omit explicitly writing the public key, and simply write respectively mcom. 

Multi-commitment mcom is used for committing to multiple messages at once, in our 
ease n messages. Furthermore, it has a homomorphic property. Le.» 
mcom^T+Mi^.-.mrt+MnjH-R) ^mcom(mi,.. . a m n ;r) * mcom{M b ^^M n ;R). 

V:\Cambridge CaseaVPJM\GBP290iS5y\OBP290 ISSyjSpectfiefttfan 
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The protocol proceeds in 7 steps: 

Common input; (ui,vi) v . M(^ v fl)*(Ui>V0,. . .,(V m V n ) and public keys, including G v H 7 h. 
Proves input: A permutation ?ceS tt ,an exponent s and randomizers Ri,. . ■ ? Rn 
satisfying G*==h and 

1 . Proven Pick r 3 at random and set e s ==mcQin(7£(l ) ? . . . ? 7t(n);r s X 
Send c 5 to the verifier. 

2. Verifier: Pick t I? . . ^t n at random and send them to the prover, 

3. Prover: Select J\ at random and set ct^mcom^i),. , ^t^jrt)- 
Send c t to the verifier, 

4. Verifier: Choose X T x at random and send them to the prover. 

■ 

5> Prover: For j=l 3 . . .,n let aj=ni=i J {^(i) 4 ' 1^r" x )- 

Select d b „,,dn at random. Select^ At random and set c^^oomCdi^.^dn;^ 
Select A2,. 5 An-i at random and set A^i AH*. Select r& at random and set 

Select r A at random and set c a =mcom(A 2 -(5i-Tt(2)+ t^y-x)Ai~aid&. . . 

Select d at random and set D=G d . Select R at random, Set U<i R uA. ..UA- 
Set V=H R (Ui **" S . . . ^{V/i . , . V B *n). 
Send CsuCd^D^UjV to the verifier. 

6, Verifier: Select e at random and send it to the prover, 

7, Proven Set f,^(;te(I)+ ^ Set z=e(^r s + r t )+** Let 
4i=e(A2-(^(2)+ t^a) -x)Ai - aid 2 >-Aida 9 ...,fAn-i=e(An--(^(n)+ 
V^^An-i-an-idn^Aa-idfl and z A ==er 2 -hr 4 . 

Set Z=R~e(ta{l)+ t < i 3 )R 1 -...-e<X^(n)+ t^ n) )R n , Set f=es +d. 
Send ft,. .->fn 3 z ? £ii 5 - *J&r-i ^,Z t f to the verifier. 

Verification: 

Check that racom(f u . . .Jtettc* x <!$%. Check that mcom^i,, . .Av-ua^K^ 
Define Fi,F2 9 ,.. 5 F n as the elements such that 

F^t-ex.eFz^FiCfe-ex^fii,. » J eF n -F^ J (4-^x)^ T1 . 1> Verify that F tt =enM fl (^ U ~x). 
Check that G^iV.-U/^i^i^^)^ Verify that G^h^D. Check that 

The protocol above is a seven-move public coin, Complete., sound and honest verifier 
zero-knowledge proof of correctness of a shuffle-and-decrypt operation, 

For ElGamal-style ciphertexts the shuffle-proof for homotndrphic encryptions described 
earlier is a special ease with 5=0, d«=0 and therefore fHX. 
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Efficient proofs for proving correctness of decryption are well known in the 
cryptographic literature. Likewise, many proofs of correctness'of a, shiuffle exist 
[FSiG.NEFOl^Npatent]. Embodiments of our proposed shoifHe-krid- decrypt proof are 
zero-knowledge and more efficient than previous proofs. The shuffle-and-decrypt 
prooS in [F ? FMMOS] are not zero-knowledge. Shuffle-and-deerypt proofs can be used 
in anonymfeation protocols; voting protocols is one particular instance of protocols 
where aoonymization is useful. 

We now give some comments that pertain to both the sero-krtowledge proof for 
correctness of a shuffle and the zero-knowledge proof for correctness of a shuffte-and- 
decrypt operation 



Que pos$ibie way to pick the parameters of the shuffle proof, or the shuffle-and -decrypt 
proof, is such that the message space of the commitment scheme and the message space 
of the cryptosystem has the same order. For instance we could let the commitment 
scheme have public key (p,q>g 5 hu..,,!^) withp being a 1500-bit prime, ci being a 160- 
bit prime dividing p-1 > and the rest being generators of the group Q n in Zp* We select 
the fs ? Xjl& as random challenges from Z q and also the d's and A 5 s as random elements 
from Zq. The cryptosystetn could be ElGamal encryption with public key (P^G^H) 
with P being a 3000-bit prime, and q being the same prime as in the commitment 
scheme dividing P4 , and (G,H) being generators of the group Hq in Z P * 

Another way to pick the parameters is such that we actually compiute the elements 
£u« , .,4 over the integers. I.e., we could let the commitment scheme have public key 
(PA&hiv i >,h n ) with p being a 1 500-bit prime, q being a 400-bit prime dividing p*l, and 
the rest being generators of the group G q in Zp*, We select the t's and X as random 160- 
bit challenges, iProvided we have less than a million messages to shuffle a value e(fa-Hi) 
is at most 340 bits and does not get reduced modulo q in Z q . Picking the d ? s as random 
elements in Z^ we get Fs that with overwhelming probability are more than 340 bits 
long, something that we can check: in the verification phase. This means that over the 
integers we have f^e(kK(i)+ t^+dj for i=l^ . T ,n. This in turn mean$, as long as the 
message space of the crypto$ystem does not have small divisors, that we have shuffled 

VACambridge Cascs\PJM^^ 
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or shuffle-and-decrypted correctly. In particular we could use suck a method to shuffle 
ciphertexts from the generalised Faillier cryptosystem of [DJOl], which has a. very large 
message space and where current shuffling techniques are not as practical 

Using the Fiat-Shamir heuristic, i. e., computing the challenges t j , . . . ? k ? K x, s and e as 
suitable cryptographic hashes makes the protocols non-interactive. This way the zero- 
knowledge proofs can also be made publicly verifiable, 

If the servers are to run either of the protocol interactively, then: we note that [GMY] 
suggests general techniques to transform honest verifier zero-knowledge proofs into 
zero-knowledge proofs. 

Using randomisation it is possible to speed up the verification* process, see [DOS] and 
[BGR] for comments on batching techniques. It is furthermore well known that various 
techniques for fast multiple exponentiation exist. 

For instances instead of verifying the last two equations in the shuffie-and-decrypt proof 
by themselves, we can pick 7 as a small random number and check whether 

» 

The protocols are statistical honest verifier zero-knowledge if the commitment scheme 
mcam is uncondtionally hiding. On the other hand, if the commitment scheme rncom is 
unconditionally binding then the protocols have ^conditional soundness. 

We next describe optimized MIX nets. 



A traditional MIX net generally consists of a number of shuffle servers, each refreshing 
the randomness part of the encryption of encrypted votes, each permuting the votes and 
each producing & zero-knowledge proof that their output is a permutation and re- 
encryption of the input. In the final step the votes must be decrypted and zero- 
knowledge proofs must be included that the votes have been decrypted correctly. The 
correctness of the result of the election can be verified by an external audit facility, 
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which verifies correctness of the counting by inspecting the input, output and zero- 
knowledge proofs of each server. 



f 



Figure 1 shows a Mix net. The S servers re-encrypt (refreshes randomness) and 
permutes votes, whereas the S* server decrypts votes. All provide zero-knowledge 
proofs that they have done their tasks correctly- 

It is not desirable that the private key used for decryption is in the possession of only 
one entity. Therefore S 1 should consist of several entities, which secret-share the private 
key of the election. However this solution is impractical 

As an example we take the [DGS] crypto system, that is ElGamal style. It is thus 
possible to share the secret key as explained above. 

We will arrange embodiments of our voting system such that each shuffle partially 
decrypts the votes using its share of the secret key The final server completes the 
decryption of (he votes and produce aero-knowledge proofs of the cotreetness of the 

■ 

decryption. In this way we will not need additional entities in order to perform the 
decryption securely. Two different types of embodiments usmg this type of encryption 
are possible. 

* • 

Embodiments where the shuffles perform zero-knowledge proofs of the 
correctness of their actions and the cryptographic keys used for encrypting the 
input and the output are different. 

Embodiments where the verification of correctness of votes and the computation 
Of the result is done out of band (e.g. using different servers) using 
homomorphie encryption properties. This is done in such a way that the shuffle 
servers do not produce zero-knowledge proofs. Instead a zero-fcaowledge proof 
of correctness of the vote is produced when the vote is created. These ssexo- 
knowledge proof? are verified by es V"-servers and the votes ate counted on 
encrypted form using the homomorphie property- Finally the results of the 
election, in individual districts but not the individual votes are decrypted using a 
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secret sharing mechanism. We will provide an example embodiment of our 
invention of this type. (hi this case the maximal security is obtained with 3 
shuffle servers and a server for decrypting the result Three servers need to 
cooperate to break the secrecy in this case. We do not consider this to be a large 
problem since three shuffle servers is the natural choice). 

A naive MDC net implementation is not very fast However, doing zero -knowledge 
proofe out of band of the shuffles and using other, generic* optimisations, it is possible 
to increase the throughput dramatically. We list a number of optimisations; 

Partially decrypting in each shuffle and not providing sero-lcnowledge proofs 
give$ a factor of about 3, 

Partial decryption and re-randomisation of votes can be parallelized arbitrarily. 
This gives an improvement of performance by a factor of 5-10. 
The order in which the servers process each vote need not be the same for all 
votes. For example if there are three servers performing re-encryption, the votes 
can be distributed in three pools depending on their election district (since the 
result will normally be specified out for election districts, permutations between 
election districts are not relevant) and the pools are rotated between the re- 
encrypting servers until each vote has been once at each server. This gives a 
factor of about 3 compared to naively letting the first server finish its work 
before the next server starts. 

If g is chosen in a subgroup of small order with elements that are 
indistinguishable from elements of the whole of Zn2* ? randomness and keys maybe 

* 

chosen shorter. Such optimisations are known for ElGamal over a -prime and are also 
possible with ElGamal over a RSA modulus. It may give a factor 2-4 depending on the 
size of the RSA modulus of the crypto system, We thus describe a method of 
committing to au electronic data value, the method comprising selecting a substantially 
random number and a sub group of the multiplication group Z* tt of integers computed 
modulo n where n is a product of two primes for the electronic data value and/or said 
substantially random number and determining a commitment value from said electronic 
data value and said substantially random number using said subgroup 
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All in all this means that detachment of identities from votes can be performed about 
45-90 times fester than for a naive MIX net implementation. The final decryption of 
votes can also be parallelized arbitrarily* 



We next describe attacks against the scheme. 

In order for a MIX net to have optimal security properties it is necessary that each 
shuffle server verify the zero-knowledge proofs of the predecessors before it performs 
its own MIX. As we have discussed ibis is not optimal with respect to performance, so 
it is fair to provide an account of the attacks made possible by not letting this 
verification take place. 

If we count the votes by an out of band method, we can be sure that it will be 
discovered if the result of the election is altered. In one embodiment, we will provide, 
such a count is done securely using a homomorphic count- Thus we will have full 
security when it comes to making sure that the result of the election is correct. 

* 

However, some attacks against the secrecy of the election are possible. Since ths crypto- 
system is homomoiphtc, the first S server can add numbers to votes and it can multiply 
the votes by a constant factor, This can normally be done in a way such that the vote as 
well as the number added can be separated from each other when/the vote is decrypted. 
We will say that the encrypted votes are marked. Depending on which servers the first S 
server cooperates with different properties of the attack are possible. 

If the first S server acte alone, the decrypting server will discover the fraud but 
also be presented for the association between identities of voters and votes cast 

♦ 

If the decrypting server is honest, not compromised and checks whether votes 
are correctly formatted before they are published, the anonymity of the election 
will not be broken, Further, the fraud will be detected and a delayed count can. 
take place \yith the first S server replaced. 

V:\Cambridge Cases\PJM\GBF290255Y\G&P290155Y_Spra^ 
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If the first S server and the decrypting server work together; they will together 
be able to break the secrecy of the election completely. Because of the zero- 
knowledge proofs of correct decryption of votes, the fraud will be detected. 
If the first S server and the decrypting server work together with all external 
audit facilities used, the abovementioned fraud need not be detected. (The 
decrypting server can in this case clean the votes before it publishes them and 
provide wrong zero-knowledge proofs that the audit facilities will let through 
undetected*) 

If the first S server and the decrypting server work together with the last S 
server, they will be able to break the secrecy together without being detected, 
(The decrypting server decrypts votes, sends them back to the last S server, 
which cleans its encrypted output for the marks and submits a new, correct 
output,) 

The basic properties are that two servers need to cooperate in order to break the secrecy, 
while accepting that their fraud will be detected. Three entities need to work together in 
order to break the secrecy without being detected. This can be improved on slightly by 
letting either the first or the last 5 server carry out a shuffle proof. 

In the case, where we have two S servers and one decrypting server we see that there is 
no real loss of security, The two S servers could anyway break the secrecy by 
interchanging permutations. The first attack also has the equivalent that one of the S 
servers submits its pemiutatiofl in clear text to the other S server. The other S server will 
of course detect and will (unwillingly) be able to break the secrecy. 

We next describe write-in candidates. 

In the US and some other countries it is common to use write-in candidates. That means 
that it is possible to vote for a candidate not on the Ii$t This cantiot be ignored for 
embodiments of systems to be applied in practice, 
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MDC nets can handle write-in candidates without problems, wtifcreas homomorphic 
encryption can't deal with write-in candidates- Below we describe how homomorphic 
"'encryption* can however be used to prove that a list of write-in candidates is correct. 
First we give some background on commitment systems: 

■ 

A verification system is a computationally hiding commitment system "that is further 

» 

supplied with a private key that breaks the computationally hiding property without 
breaking the coranitment system properties. That means that a pez^on m possession of a 
secret key X for the verification system will be able to verify a claim that a given 
commitment contains a given message without being provided with an opening of the 
commitment. However, knowledge of X will not provide any knowledge at all about the 
cipher-text space of the commitment system. In particular, the cipher-text space 
observed by a person with knowledge of X may appear to be an infinitely large space 
like Z just as if the person had not been in possession of X. 

A homomorphic verification system is a verification system for which the underlying 
commitment system is homomorphic. 

Example; Consider Z na where n is an RSA modulus with unknown factorisation. Pick 
generators f and fa of Zn*. and set g « I s for a randomly chosen X. We define the 
ElGamal style homomorphic system 

V(m;r) = <i* fc m g-) 

Then V is a homomorphic commitment system and X is the secret key that breaks the 
computationally hiding property. 

Please notice that V is not a crypto system* The discrete logarithm m Z rt cannot be 
Computed efficiently, so decryption is impossible if n is a large RSA modulus, In fact, if 
decryption were possible in general, the real message space would be known, which 
would imply breaking the RSA modulus, which is clearly not possible from the 
information given. Also iti this way we see that the message space is Z, so the basic 
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properties of the commitment systems are preserved. However notice that the 
commitment system is only computationally hiding rather than statistically hiding 
because it is possible to compute X for a computer with unlimited computing power. 

In short we observe that this system has the property that the message space is all of Z } 
that the system is computationally hiding for aa adversary without knowledge of the 
secret key, but entities with knowledge of the secret key are able to verify a claim 
efficiently that a commitment is a commitment to a particular value. Further, the private 
key can be secret shared like for other ElGamal style systems. 

We remark that cryptographic primitives with the same properties as verification 
systems but without the homomorphic property are easy to construct from standard 
cryptographic primitives. For example one cam take a hash function H with 16 byte 
output, consider the hash value H(m) as an AES key, use this key to encrypt a fixed 
value and finally encrypting the result using a public RSA key. This primitive allows 
persons in possession of the corresponding private RSA key to verify whether it was 
computed on a fixed value whereas it is computationally hiding for persons not in 
possession of the private key. Such a primitive could for example be used for tfcae- 
stampiiig systems that allow only particular entities to verify time-stamps. 

One novel aspect of embodiments of our invention of homomorphic verification 
systems is therefore the ability to verify several claims in one combined operation while 
keeping some properties of the individual claims secret. In the novbl applications for 
voting systems we shall see, it will be the origin of the individual messages. 

In an aspect of the invention use of homomorphic verification systems for verifying that 
messages m i,*.,m * are authentic without revealing their origin in the following way: 
The entities {Ej} producing the messages each choose large random numbers e h and 
p j. They submit nij, V(e j. rj) anonymously to one entity (entity A) and V(mi ej,, pj) to 
another entity (entity B) in such a way that it is properly authenticated. The authenticity 
of the {m j) is verified by having entity B submitting II V(e j, rj)™ j to entity A, which 
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Computes C = n V(m j e lh p j)" 1 V(e j, rj) m j . Finally a trusted entity, which knows X, 
verifies that C is a commitment to zero. 



Let E denote a homomarphic crypto system. The implementation to- ft£ context of a 
voting system can be done a$ follows (for simplicity we use V as commitment system 
also, in practice some commitments would be done m a simpler system, which is 
preferably statistically hiding): 

Let v be the vote, v=2Sj M J . Some indices j represent write-in votes, whereas 
others represent candidate or list votes. M = p , where p is a prime. M is strictly 
larger than the number of votes any candidate can get In particular, for elections 
where each voter has a single vote, M is strictly larger than the number of voters, 
(See [DGS], [DJ01]> 

■ 

Submit E(y), V(23j fr 1 ) together with a non-interactive zero-knowledge proof of 
equivalence between the two and a no^-intetactive zero-knowledge proof that 
the vote conforms with the rules of the election (see [DQS], [DJ01]). 
Let m be a write-in vote corresponding to index k, (For example m = s< Tom 
Jones" if the voter wants to vote for a person called Tom Jones that is not on the 
list. If a list candidate is selected instead, m should instead be a numeric zsro 3 or 
another fixed value). Submit E(m) ? V(m) together with a nos-kteractive zero- 
knowledge proof of equivalence of E(m) and V(m) and a non-interactive zero- 
knowledge proof that either m=0 or 8* = 1. (This can be done by decomposing 
V(S5j p j ) into two commitments Vi V(S fc p*) and v 3 ~V(Sj & Sj p*), proving 
that either vj or V(-p k ) n is a commitment to zero and proving that the content 
Of either V(m) or V^p*) v t is a commitment to zero. Snch proofs are standard.) 
Pick a random number e m and submit and VCm^ together with a 
multiplication proof that the content of V(me m ) is the product of the content of 
V(e m )andV(m)> 

Sign the entire vote including all proofs- 
Notice that the number e m will never become known to anybody since no encryption of 
it is submitted. 
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Now say that we count Hie votes by using the homomorphic property and decrypt the 
result. By using the homomorphic property we get the encryption: 

V, = V(S me*) = n V(mem). 

If we also use a 'MIX net% we get the individual numbers in and. coupled in pairs 
but detached from the identities of the voters. Thus we may compute 



V 2 - V(S me m } = U VCeJ- 

Using the secret key X, secret shared between the same persons that share the private 
key for the crypto system (homomorphic sharing? not the sharing between 'MIX' net 
servers), we can check that V x and have the same content, If the e m were chosen 
large and random, there is in practice no way to fake this. 

In an aspect of the invention we use the above mechanism to check the write-in votes 
coming out from a MIX net- 
In an aspect of the invention we also use the above mechanism in the way that all votes 
are treated as written-ia votes, i.e. instead of zero-knowledge proofs of correctness of 
nom-ial votes one uses this mechanism. 

la an aspect of the invention we also use the above mechanism fox verifying correctness 
of encrypted information linking electronic ballots to paper ballots, (The information 
linking electronic votes to paper voters takes the role of m. This is similar to above 
except that in this case there need be no proof linking m to m ordinary vote,) 



We next outline attacks against the scheme. 



If the machines from where voters vote leak the eiit may be possible for the las* shufHe 
server and the decrypting server together to produce different m J s. Notice however that 
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this requires three cooperating entities and will with, a high probability be detected by 
the tests against paper ballots in our invention. 

Also $ome attacks against ike secrecy of the election are possible. The first S server can 
replace E(m{) and Vfe) in some ways: 

. Replaced by ^(m) A mod H and V(e ; ) 2 or by higher powers of 54 and 2. If write-in 
votes are published no matter whether Qiey make sense or not, or if the first S 
server works together with the decryption server, this can be used to check what 
individual voters voted. This will be detected unless further the last S server is 
also involved in the fraud. 

Replaced by E(mj) 2 E(-nio) and V(ej). This can be done and will pass all tests 
provided that the first S server correctly guesses the content of each vote it 
tampers with. 

The last attack is potentially rather serious because the first S server can be buying votes 
and u$e it for verifying that the vote-sellers deliver. Consequently, as long as vote- 
sellers are honest this vote buying will not be detected. However, if a vote-seller does 
not deliver* the fraud will be detected. This attack (and similar ones with different 
powers than 2) can be made infeasible by including a few random bits in each vote at a 
specific location. 

Again w$ conclude that whereas this is not quite as secure as a MK net where all 
shuffle-proofs of predecessors are verified before the nest shuffle server starts, attacks 
against the integrity of the election require three cooperating entities and will be 
detected with a high probability whereas attacks against the secrecy of the election with 
potential for not being discovered require at least two cooperating entities if the vote$ 
are enhanced with a few random bits. 



We now describe signing votes. 



16-JUN 



-2004 1?=12 FROM MARKS & CLERK 



TO PAT OFF GB 




We first remark that embodiments of the inventions claimed are-possible without using 
digital signatures, Nevertheless it is preferable that encrypted votes are digitally signed 
such that there is 100% accountability about exactly where each electronic vote came 
from. Some pilot systems have attempted to use chip cards for that purpose, but face the 
difficulty that chip cards arc expensive and that chip cards wilt signing keys axe not 
widespread. The Cybervote project is an example. DKJS systems also use chip cards, 
but in a different way that is not related to digital signatures and does not provide the 
accountability we are discussing. 

Alternatives to using a portable device like a chip card to store the private keys of the 
voter on are not store the private key; or store the private key in a non-portable device. 

The first option is taken in the e-Vote project, where the Internet-voting pilot system 
works in the way that a public/private key pair is generated in ah applet running on the 
computer of the voter. A certificate on the public key is then issued on the fly based on 
credentials that the voter receives by mail such that the vote caa be properly signed, 
Depending on the procedures applied for distributing the credentials and the properties, 
configuration and operation of the on-line CA, this maybe a legally binding signature. 
By using this mechanism the e-Vote system is optimal in the sense that it uses the 



simplest and cheapest possible mechanism for creating legally binding signatures on 

* 

encrypted electronic votes, 

For an e-voting system that takes place at election sites it is however unacceptable that 
the devices used for casting votes store the private key of the voter (when also, 
supposedly, only for a short time). The remaining option is thus to store the private key 
in another, non-portable device. Such a device - which we call the Signer - is described 
in out patent application PCT/GB02/03 707 3 WO03/Q15370, hereby incorporated in its 
entirety by reference. The Signer can then be operated at central locations different firom 
election sites. Digital signatures are produced by the Signer on the basis of credentials 
provided by the voteis, and each digital signature is logged by the Signer, 
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It is strongly preferable that two-factor authentication is used for voting. We preserve 
the option that the voter receives both, factors in one letter. This is not really a problem 
since the identity of the voter can be checked when giving offthe first factor (with the 
same level of scrutiny that is used for manual elections, that differs a lot from country to 
country). The central point is that vote buying must be prevented by having a public md 
a private authentication factor. One factor h preferably nased in the public sphere, such 
that vote buying by buying credentials cm be prevented. The other factor is used in 
privacy when the vote is cast, such that accountability is assured. The Signer is designed 
to deal with two-factor authentication in a highly secure and tamper resistant way since 
it is distributed, in two servers that each know of one fector of the authentication- 

4 

We conclude that circumstance dictate the Signer approach to be the preferred solution, 
both cost-efficient and secure to use. However, if the Signer is used it is sufficient that 
oach voter receives a voter card by mail as usual with two authentication factors printed 
on it in order to produce digital signatures. 

Use of the Signer preferably requires the e-Voting system to be on-line. However the 
security (at least security against undesired influence on the outcome of elections) does 
not rely on confidence in the device used for casting votes and printed ballots may serve 
as backup in case of lacking on-line availability (Le, a manual count), 

We next describe some example embodiments. 

First we give two examples of how to encrypt information linking electronic md paper 
ballots 

1) Enlarge homomoiphically encrypted votes (like the cryptosystems in [DJ] or 

[PGS]) such that the plain-text space is Z^s+i instead of Z^s and the cipher space 
is correspondingly Z n s+2 instead ofZ^s+i .Represent (vote, manual ballot) as vote 
+ il (manual ballot). Project the encrypted vote on ZnS+2 before doing the zero- 
knowledge proof of correctness of the vote (this corresponds to removing the 
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term rf (manual ballot) in the plain text space). See [DJ01], hereby incorporated 
by reference, for further details about how this machinery works. 
2) Combine two homomoiphie encryption keys to produce a key with the product 
cipher space and cleartext space. We let the orders of clear-text spaces and 
ciphertext spaces be mutually prime for letting the product space have similar 
properties to the component spaces. Do homomorphic encryption proofs in the 
vote space only, but do the MIX net proof in the product space (if a MIX net 
proof is done). 

We describe a realisation below that is as simple as possible. This system is an example 
of a traditional MIX net system enhanced with additional information linking electronic 
ballots and paper ballots: 

Referring to Figure 2 we describe the individual components: 

The "Registration Facility" is a public sector system for keeping track on the 
eligible voters. The registration facility interfaces with the Signer for registering 
voters for the system. 

The Signer is the signature server referred to above, which is used for keeping 
track on voter credentials and voter identities in the voting system and for 
signing electronic votes. When voters are registered on the Signer, the Signer 
registers them at a CA for certification. The Signer further sends credentials to 
the voters and makes available functions for disabling voters who cease to be 
eligible or loose their credentials. 
The CA issues certificates on voters. 

The "Enter Voting Site Application" accepts one credential from the voter, 
which is provided in public. In this way it is prevented that voters can buy 
credentials and bring more credentials with them into the place where votes are 
cast, A manual check of the voter identity is carried out when the "Enter Voting 
Site Application' 5 is used. The "Enter Voting Site Application" is also 
responsible for handling and logging most exceptions to the normal flow of 
events (examples: A voter identifies himself but has lost his credentials. A voter 




loses his second piece of authentication inside the voting site. A voter changes 
his mind before submitting the paper ballot but alter having submitted the 
electronic ballot). There axe many routine ways of handling such exceptions. 
The "Voting Application" is the application/machine used for casting votes. This 
can for example be a touch screen machine. If write-in votes are possible, an 
equivalent of a keyboard should be available for entering the name and possible 
more information on the write-in candidate. The voter selects his choices and 
gives off his second credential that is used for having the Signer signing the 
vote, A£ a result an electronic ballot and a paper ballot are created. The linking 
information can, for example, bs created by the Voting Application as an 
identifier of the election district followed by random numbers generated at the 
time of voting, It can, for example, be included in the electronic vote in the way 
described above and it call for example be represented in bar code on the 
backside of the printed ballot. The electronic vote is seat on-line to a collection 
point, whereas the voter carries the manual vote out in the public sphere, where 
he enters it into a traditional ballot box. 

The tf< Local Check Program" is a program used for checking the votes after the 
election is finished. (Scanning of information Unking paper ballots to electronic 
ballots, checking correspondence by carrying out an interactive protocol with the 
on-line election result entity with information on electronic ballot^ checking 
that the number of paper ballots equals the number of electronic ballots and 
checking a selected number of ballots, in embodiments less than 200, with the 
corresponding electronic ballot, again by carrying out an interactive protocol 
with the "On-line Election Result" entity*) 

The "Collection Point" is a server, which collects votes from at least one district 
and checks syntax and digital signatures on the votes. 
The S servers are servers holding a shan? of the private keys of the election. 
They partially decrypt and permute votes and generate a non-interactive zero- 
knowledge proof that they have done the job correctly. 
The S 5 server performs the last part of the decryption and provides a non- 
interactive zero-knowledge proof of correctness of the decryption of each 
individual vote. 
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The "Key Generation Application 5 * is an off-line application operated under 
particularly stringent security measures used prior to the election for generating 
key paijre of the election (crypto system, commitment system)* The public keys 
and private key parts are distributed to the relevant entities. "Notice that the S 
servers should be operated by different organizations/persons in order to ensure 
secrecy of votes. 

Referring to Figure 3 we describe a realisation below that is optimised for performance 
and security in the sense that perfomiance-demanding generation of zero4aK>wledge 
proofs is done at the election sites and verification is scalable, such that all *ero- 
fcnowledge proofs can be verified before the result is published. 

We briefly describe the individual components: 



The registration facility is a public sector system for keeping track on the 
eligible voters. The registration facility interfaces with the Signer for registering 

■ 

voters for the system* 

The Signer is the signature server referred to above, which is used for keeping 
track on voter credentials and voter identities in the voting system and fox 
signing electronic votes. When voters are registered on the Signer, the Signer 
registers them at & C A for certification. The Signer further sends credentials to 
the voters and makes available functions for disabling voters who cease to be 
eligible or loose their credentials. 
The CA issues certificates on voters. 

The "Enter Voting Site Application" accepts one credential from the voter, 
which is provided in public. In this way it is prevented thai voters can buy 
credentials and brmg more credentials with them into the place where votes axe 
cast- A manual check of the voter identity is carried out when the "Enter Voting 
Site Application" is used. The "Enter Voting Site Application" is also 
responsible for handling and logging most exceptions to the normal flow of 
events (examples: A voter identifies himself but has lost his credential*. A voter 
looses his second piece of authentication inside the voting site. A voter changes 
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his mind before submitting the paper ballot but after having submitted the 
electronic ballot}- 

The ^Voting Application" is the application/macliine used for casting votes. This 
can for example be a touch screen machine. The voter selects his choices and 
gives off his second credential. If write-in votes are possible, an equivalent of a 
keyboard should be availabte for entering the name and possible more 
information on the write-in candidate. As a result an electronic and a paper 
ballot are created. The linking information can for example be created by the 
Voting Application as an identifier of th$ election district followed by random 
numbers generated at the time of voting. It can for example be included in the 

> 

electronic vote in the way described above and it can for example be represented 
in bar code on the backside of the printed ballot- A non-interactive zero- 
knowledge proof of correctness of the electronic vote is attached to the 
electronic vote. The electronic vote is signed by the Signer using the second 
credential of the voter. The electronic vote is sent on-line to a collection point* 
whereas the voter carries the manual vote out in the public sphere, where he 
enters it into a traditional ballot box. 

The '"Local Check Program" is a program used for checking the votes after the 
election finished. (Scanning of information linking paper ballots to electronic 
ballots,, checking correspondence by carrying out an interactive protocol with the 
on-line election result entity with information on electronic ballots, checking 
that the number of paper ballots equals the number of electronic ballots and 
checking a selected number of ballots, presumably less than 200 a with the 
corresponding electronic ballot, again by carrying out an interactive protocol 
with the '^On-line Election Result" entity.) 

The "Collection Point" is a server,, which collects votes from at least one district 

and checks syntax and digital signatures on the votes. 

The S servers are servers holding a share of the private keys of the election. 

They re-ettcrypt and permute votes (zero-knowledge proofs and the signature are 

removed). 

The S' server performs the last part of the decryption and provides a proof of 
correctness of the decryption of each, individual vote, 
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The 6f Key Generation Application" is an offline application operated under 
particularly stringent security measures used prior to the election for generating 
key pairs of the election (homomorphic crypto system, homomorphic 
commitment system and homomorphic verification system). The public keys 
and private key parts (secret shared in two different ways) are distributed to the 
relevant entities. Notice that the 3 servers should be operated by different 
organizations/persons in order to ensure secrecy of votes. 
The V servers axe used for verifying zero-knowledge proofs on the individual 
votes. Notice that the scheme for write-in candidates, where also list votes are 
checked using a verification system, allows for no V servers. This however has 
the disadvantage (as in all schemes involving depersonalization of votes only) 
that votes filled in ways that should not be allowed by the software of the Voting 
Application cannot be traced back to their origin. With V server in place votes 
with invalid zero-knowledge proofs can be linked to the identity of the voter. 
Therefore there is a significant role to play for V-servers. 
The "Homomorphic Count" is a server where votes with valid zero-knowledge 
proofs are counted on encrypted form using the homomorphic property without 
decrypting individual votes. Further, write-in votes and the electronic version of 
the information linking electronic and paper ballots can be taken in to do a full 
verification, In an interaction with a trusted group of people each holding a 
secret share of the private keys of the election, the result of the election is 
decrypted. A complete audit trail with zero-knowledge proofs that everything 
has been done correctly is produced and stored/exported for external audit. 
The TS servers are threshold servers, applications that allow the key share 
holders to use their key shares for decrypting the result of the election. 
The "External Audit Facility'* is a facility that checks that the steps carried out 
by the V servers and the homomorphic count were performed coxrectly. 

Please notice that not all relevant arrows are included in the drawing. For example 
arrows with origin at the key generation server have been left out for simplicity. 
Further, feed-back is helpful in a number of situations in order to deal with eiro? and 
fraud situations. For example feed-back from the V-servers to the collection point is 
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preferable in the case* where there are votes with valid content but invalid zero- 
knowledge proofs. 

The invention also provides, in a further aspect of a special variant of a user interface to 
the local check program. An embodiment of this is described below: 

The container for collecting ballots is separated into two or more physical 
containers. 

When the voter wants to submit his vote he physically interacts with the device 
resulting in the device bringing itself in a mode* where it is possible for the voter 
to enter his ballot in at least one of the containers but not both/all 
The ballots entered into one/some of the containers will be subj ected to checks 
against the electronic ballots, possibly different types of checks depending on 
the container, whereas the ballots entered into (the) other containers) will not be 
checked against electronic ballots. 

Figure 4 shows a device for selecting ballots to bis checked, A more sophisticated 
version of such a device is also possible, In addition to a button to press for entering a 
ballot a scanner is available. The procedure is as follows: 

- The voter presses the button (or in another way makes aware that the device must 
make its choice). 

- The device indicates which slot will be opened, for example by lighting up the slot to 
be opened. 

- The voter uses a scanning device to scan the information on his ballot linking it to an 
electronic ballot. 

- The device opens the slot indicated, 

- The voter enters his vote^ 

In this way the manual ballots will all be processed during the election with exception 
of the reading of the content of ballots to be checked, This simplifies the step after the 
election is over to actually enter the content of the ballots to be checked. 
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The two steps, first pressing the button, only then scanning the ballot, are there to 
ensure that it will be substantially impossible for the electronic Voting system to signal 
to the device in a reliable way, which ballots shall not be checked. 

Figure 5 shows a device for selecting ballots to be checked with scanner. In order to 
apply this scheme it is preferable to form the ballots in a way such that the information 
linking them to electronic ballots can be scanned wiuiout revealing the content of the 
ballot. This can be done by having the information linking the physical and electronic 
ballots written on the backside of the physical ballots near the top or the bottom of the 

ballot. 



Figure 6 shows a ballot with scannable text field. 

Figure 7 illustrates the information that can be contained in a paper ballot and in the 
corresponding electronic vote. The shaded area is the part of the electronic vote that is 
encrypted. 

Figure 8 illustrates how the encrypted content, but not the digital signatures and zero- 
knowledge proofs may be homomorpliically counted on encrypted form to deliver an 
encrypted result in a homomorphic count. 

Figure 9 illustrates how a shuffle changes the encryption and the ordering of electronic 
votes and produces a zero-knowledge proof of the correctness of its actions. 

In embodiments where electronic votes rather man printed ballots are sampled, we 
propose that the "On-line Election Result* component or a component with access to 
the information provided by the "On-line Election Result" component selects the 
sample, The election districts with samples to check are theft informed and must now 
count their printed ballots, find the printed ballots corresponding to electronic ballots 
and verify that the selection of candidates on the manual ballots is the same as in the 
electronic ones. Comprehensive procedures and protocols that can be a combination of 
manual steps and cryptographic protection in the communication between the election 
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district and the entity selecting the samples are preferably employed in order to make 
sure that the information communicated correctly reflects the information contained m 
electronic and printed ballots. It is also possible that a person from the organisation 
selecting the samples -will be personally present in the individual election districts to 
Inspect printed ballots directly or that printed ballots corresponding to electronic votes 
sampled or all printed ballots in the district are submitted for independent audit. 

When the election is over many options are available for verification and fine counting, 
providing full accountability of the system: 

1) Verifying correctness of the verification and counting by at* independent 
organisation using independent software. This is standard universal yerifiabiiity 
carried out at the "External Audit Facility* 7 . 

2) Verifying the Signer log against the votes. In particular verifying that there is no 
systematic double signing. Vetera who have signed more than once can be 
doubte-checked for, whether they got the permission {log from "Entry Election 
Application'*)- 

3) Selecting an adequate number of randomly chosen depersonalised votes for the 
whole country (a predetermined number, fox example about 459 (of more) in our 
proposed solution). Do a test that each of those votes corresponds to a manual 
vote by a manual procedure in election districts. 

4) For each district, selecting an adequate number of randomly chosen votes (a 
predetermined number, for example about 194 in our proposed solution). Do a 
teat that each of those votes corresponds to a manual vote by a manual procedure 
in election districts, In contrary to 3), this work can be distributed over months 
(however, in the example embodiments given, it is done just after the election or 
even in parts during the election). 

If l)-4) are all successful and no other factors indicate that the^e is increased risk that 
this election has been tampered with, it will be natural to stop here, If however, one of 
the tests is not successful^ a number of steps can be taken. 
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Electronic logs from voting sites can be compared to central logs from the 
Signer and tile counting facilities. The result of this comparison may give an 
indication about, in which parts of the country a closer investigation shall take 
place, 

Selected or all districts can perform a manual recount 

Selected or all districts can perform an extended manual recount involving the 
following: All electronic votes cast in the district are depersonalised in a MIX 
net. Each electronic vote is matched with a printed ballot. 
In districts where the ahovementioned pairing of electronic and manual votes 
cannot be performed with sufficient success, a new election maybe called for. 
It is also possible with the help of highly trusted persons holding shares of the 
key used for decrypting the result of the election, to gall in voters and have their 
votes decrypted such that they can judge about, whether fraud has taken place in 
the manual or the electronic system. 



We observe that with the embodiments of the system proposed, benefits of several kinds 
can be achieved: 

Cost savings: For elections carried out in an orderly fashion, costs for counting 
can be limited significantly by having few locations, where counting takes place 
and counting votes almost 100% electronically. 

Increased services to voters: If the system is designed to do so 3 voting from 
arbitrary voting sites for each voter is possible because everything is electronic, 
Security: If the result of m election is disputed, (here is much better accounting 
that in a manual election because the printed ballots can be compared to the 
electronic ones to establish which ballots have been tampered with. 



Not all embodiments are optimal on each individual category, for example Internet- 
voting systems without security features build in optimise the first two while completely 
sacrificing the third. However, we describe a good compromise and leave a lot of room 
for election organisers to select just the solution that meets their requirements optimally. 
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For example the scheme described is compatible with having Internet-voting also for 
selected categories of voters, like voters living abroad. 

No doubt many effective alternatives will occur to the skilled person. It will be 
•understood that the invention is not limited to the described embodiments and 
encompasses modifications apparent to those skilled in the art lying within the spirit and 
scope of the claims appended hereto. 
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CLAIMS: 



1 . An electronic voting system* the system comprising: 

a voting device configured to generate, in response to a voter selection for each 
of a plurality of voters an encrypted electronic ballot and a printed ballot, both having 
voter selection data indicating a said voter's choice, said electronic ballot including 
information to link it to said printed ballot and said printed ballot including information 
to link it to said electronic ballot; 

an electronic vote decryption system configured to receive electronic ballots 
from said voting device and to decrypt said encrypted electronic ballots including said 

linking information; and 

a vpting verification system configured to receive decrypted voter selection data 
and linking information from said vote decryption system, to receive voter selection 
data and linking information from said printed ballots and to compare voters choices for 
a sample of said printed and electronic ballots linked by said linking information, to 
verify the voting* 

2. An electronic voting system as claimed in claim 1 further comprising a ballot 
box to receive said printed ballots, and a printer coupled to $aid voting device to print a 
said printed ballot for verification "by a voter priot to reception of said printed ballot by 
said ballot box, 

3. An electronic voting system as claimed in claim 2 wherein said "ballot box 
includes means to select a sample of said printed ballots for said voting verification 
system- 



4 r An electronic voting system a$ claimed in claim 1 , 2 or 3 wherein said linking 
information included with said printed ballot is printed onto said ballot such that it is not 
directly readable by a human. 
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5, An electronic voting system as claimed in any one of claims 1 to 4 wherein said 
sample comprises a predetermined number of ballots, preferably at least 190 3 more 
preferably at least 450. 



6. An electronic voting system as claimed in any preceding claim wherein said 
voter verification system is further configured to determine that all said printed ballots 
carry different linking information, that each said printed ballot links to an electronic 
ballot, and that the number of printed ballots is the same as the number of electronic 
ballots. 

7. An electronic voting system as claimed in any one of claims 1 to 6 wherein a 
said encrypted electronic ballot includes voting district identification information, and 
wherein said comparing of printed and electronic ballots is performed for a selected said 
district* 



S. An electronic voting system as claimed in any preceding claim wherein a said 
electronic ballot includes voter identification information* and wherein said vote 
decryption is further configured to separate said voter selection data from $aid voter 
identification information prior to providing said voter selection data to said voting 
verification system. 

9. An electronic voting system as claimed in claim 8 wherein said separating 
comprises a mix-net shuffle operation to provide at least one shuffle of said voter 
selection data. 

10, An electronic voting system as claimed in claim 9 wherein said shuffle operation 
provides a plurality of shuffles in which each ahuffie has a share of a secret key, and in 
which each shuffle partially decrypts said encrypted electronic ballots using said secret 
key share, 

"IT; An electronic voting system as claimed in claim 9 or 10 wherein said decryption 
system includes at least one first server to implement said mix-net, and at least one 
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second server to provide verification data to demonstrate that a said shuffle does not 
modify a said voter's choice. 

12, An electronic voting system as claimed in claim 1 1 wherein said verification 
data comprises a zero-knowledge proof, and further comprising an audit system to 
output audit data, said audit system including a homoraorphic verification system to 
operate on said verification data from said plurality of shuffles to count votes with 
verified acknowledge proofs without decrypting a said encrypted electronic ballot. 

13. An electronic voting system as claimed in any preceding claim further 
comprising means to process write-in-votes, 

1 4, An electronic voting system as claimed in any preceding claim further 
comprising a signer to sign a said electronic ballot, said signer being coupled to said 
voting device and configured only K produce a digital signature for a said electronic 
ballot in response to input of at least two items of voter authentication. 

15. A computer system for verifying an electronic voting system as claimed in claim 
1 9 the computer system comprising: 

data memory operable to store data to be processed; 

program memory storing processor implementable instructions; and 

a processor coupled to said data memory and to said program memory to load 

and implement said instructions, the instructions comprising instructions for controlling 

the processor to: 

receive decrypted voter selection data and linking information from said vote 
decryption system; 

receive voter selection data and linking information from said printed ballot$; 

and 

compare voters choices for a sample of said printed and electronic ballots linked 
by said linking information to verify the voting. 
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16, A computer system as claimed in claim 15 wherein said instructions further 
comprise instructions for controlling the processor to: 

determine that all said printed ballots carry different linking information; 

determine that each said printed ballot links to an electronic ballot; and 

determine that the number of printed ballots is the same as the number of 
electronic ballots; 

to thereby verify said voting. 



17. A carrier carrying the processor implementable instructions of claim 1 5 or 1 6. 

18. A device for collecting ballots, in particular for the electronic voting system of 
claim 1, the device comprising: 

a ballot input to accept a ballot submitted by a user; 
a first ballot holder for holding ballots for checking; 
a second ballot holder; and 

a user interface to allow said user to signal to the device an intention to submit 
said ballot; and 

a selector responsive to said signal to select substantially at random one of said 
first and second ballot holders to receive said submitted ballot. 

19. A claim as claimed in claim IS further comprising a ballot reader to read 
information on a said ballot lirfdng the ballot to an electronic ballot; and -wherein in 
response to said signal the device i$ configured to select a said ballot holder, to indicate 
said selection to said user, and then to read said linking information on ballot. 

20. A printed ballot for an electronic voting system configured to count electronic 
ballots corresponding to printed ballots, said printed ballot bearing information linking 
the ballot to a said electronic ballot and information to allow a voter to identify one or 
more choices, the printed ballot being configured or configurable $uch that said linking 
information and said choice identification information are b oth visible, bn jjqot 
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21 . A printed ballot as claimed m claim 20 wherein said linking information and 
said choice identification information are on opposite sides of said ballot. 

22. A method of operating an electronic voting system, the method comprising: 
collecting a vote fzom a voter; 

ontputting vote as both an encrypted electronic ballot and a printed ballot, each 
of said printed and encrypted electronic ballots bearing information linking it to the 
Other; 

displaying the printed ballot to the voter; 
collecting the printed ballot; 

repeating said collecting, outputting, displaying and collecting for a plurality of 

other voters; 

decrypting and counting said electronic ballots; 

selecting a sample of said printed or electronic ballots and reading voter choices 
for said sample; 

reading voter choices for electronic or printed ballots linked to said selected 
ballots by said linking information; and 

comparing said voter choices read from $aid sample and said linked ballots to 
verify a result of said voting- 

23* A method as claimed in claim 22 wherein said encrypted distance ballots are 
ftomomorphically encrypted, the method further comprising repeatedly permuting and. 
re-eftcrypting said electronic ballots prior to said decrypting; and verifying said result 
using a homomorphic verification system. 

24. A method as claimed in claim 23 wherein said verifying comprises verifying the 
correctne$s of said linking information. 

25- A method as claimed in claim 23 or 24 wherein said repeated permuting and re- 
encrypting further comprises partial decryption of a said electronic ballot 
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26* A method as claimed in any one of claims 23 to 25 further comprising producing 
and verifying a zero-knowledge proof of said repeated pennutmg, re-encrypting and, 
when dependent on claim 25, said partial decryption, 

27- Computer program code, in particular 011 a carrier, to implement the method of 
any one of claims 22 to 26. 

28, A method of committing to an electronic data value, the method comprising 
selecting a substantially random number and a sub group of the imdtiphcation group 
Z\ of integers computed modulo n where n is a product of two primes for the 
electronic data value and/or said substantially random number and determining a 
commitment value from said electronic data value and s^id substantially random 
number using said subgroup. 

29, A method of providing information for verifying correctness of a permutation of 
encrypted messages performed using one or more data processing entities, the method 
comprising; 

sending a commitment (c 5 ) to a first set of values (ff) defining said permutation 
to a verifier; 

receiving a second set of values (t) from said verifier; 

perniuting said second set of values with said permutation; 

sending a commitment (cO to said permuted second set of values to said 

verifier; and 

sending additional information to said verifier for verifying correctness of said 
permutation, said additional information verifying that said second set of values was 
permuted with said permutation. 

30, A method 35 claimed in claim 29 wherein said sending of additional information 
comprises: 

receiving a pair of challenge values (K x) from said verifier; 
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determining a third set of values (a) from said permutation, said second set of 
values and said pair of challenge values and sending a commitment (c*) to said third set 

of values to said verifier; 

determining and sending a commitment (c d ) to a fourth set of random values (d) 

to said verifier; 

detemiixung a fifth set of random values (A) and sending a commitment (pid to a 
combination of said fbwth and fifth sets of values to said verifier; 

sending a check value (B) derived from a further random value (R) to said 
verifier; 

receiving a further challenge value (e) from said verifier; and 
sending values (f, z, Z) determined from said further challenge value, said pair 
of challenge values, said further random value, and said permutation to said verifier; 
whereby said verifier is able to verify said correctness using a zero-knowledge 

protocol. 

31. A method of providing information for verifying correctness of a combined 
permutation and partial decryption of encrypted messages performed using one or more 
data processing entities, the method comprising: 

sending iirfonuation to said verifier for verifying correctness of said combined 
pennutation and partial decryption, said information comprising information to enable 
said verifier to verify said performance using a zero-knowledge protocol. 

32. A method as claimed in claim 3 1 wherein said information sending comprises: 
sending a commitment (c s > to a first set of values (tt) defining said permutation 

to a verifier; 

receiving a second set of values (t) from said verifier; 

permuting said second $et of values with said permutation; 

sending a commitment (c r ) to said permuted second set of values to said verifier; 

receiving a pair of challenge values ( \ x) &om said verifier; 

determining a third set of values (a) from said permutation, said second set of 
values and said pair of challenge values and sending a commitment (c a ) to said third set 
of values to said verifier; 
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determining and seeding a commitment (cd) to a fourth, set of random values (d) 
to said verifler; 

sending a triplet of check values (D* U, V) derived from a pair of random values 

(d, R) to said verifier; 

receiving a further challenge value (e) from said verifier; and 

sending values (£ z s Z) determined from said further challenge value, said pair 

of challenge values, one of said pair of random values, and said permutation to said 

verifier. 

33. A method of shuffling and decrypting encrypted electronic data using a plurality 
of data processing entities, each entity having a $hare of a secret key, the method 
comprising, at each of said entities, partially decrypting and re-randomising said 
electronic data using said secret key share such that a final said data processing utility 
fully decrypts said data, 

34 A method as claimed in claim 33 further comprising shuffling said electronic 
data and generating a shuffle proof for verifying said shuffling at each said data 
processing entity, 

35, A method as claimed in claim 34 further comprising verifying each said shuffle 
with one or more data processing entities. 

36, A method, in a computer system, of providing data for verifying that messages 
of a set of messages provided from a corresponding set of entities are authentic, the 
method comprising: 

selecting, for each said entity, first second and third random numbers; 

determining, for each said entity, first and second verification values fiom 3 
respectively, $aid first and second random numbers and said entity^ message, and said 
first and third random numbers; and 

outputting, for each entity, said entity's message and said first and second 
verification values. 
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37. A method for providing data for verification systems fox verifying that messages 
m ,„.,m k are authentic using a homomorphic verification system without revealing their 
origin, the method comprising entities {E,} producing the messages each choosing 
random numbers e h rj and Pj and submitting tn b V(e }i rj) anonymously to one entity 
(entity A) and V(m j e Pj) to another entity (entity B) where V is a verification 

function, in particular a homomorphic function, in such a way that the messages are 

authenticated. 



38. A method for verifying messages using data provided as claimed in claim 37 
wherein the authenticity of {m j} is verified by having entity B submitting II V(e j, rj> 
to entity A, which computes C = LT V(mj e j4i p if 1 V(e j, itf™ K then an entity which 
knows a secret key for V verifying that C is a commitment to zero. 



m j 



39. "Use of the method of claim 37 or 3 S to check write-in votes outputted fiom a 



MDCnet. 



40. Use of the method of claim 37 or 38 for proving correctness of electronic votes 
in a voting system. 

41. Use of the method of claim 3 7 or 3S for verifying correctness of encrypted 
information linking electronic ballots to paper ballots. 



42. Computer program code to, when running, implement the method of any one of 
claims 2S to 38. 



43 . A carrier carrying the code of claim 42. 
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ABSTRACT: 



This invention is generally concerned with systems and methods for electronic voting. 

An electronic voting system^ the system comprising: a voting device configured to 
generate, in response to a voter selection for each, of a plurality of voters an encrypted 
electronic ballot and a printed ballot, both having voter selection data indicating a said 
voter's choice, said electronic ballot including information to link it to said printed 
ballot and said printed ballot including information to link it to said electronic ballot; an 
electronic vote decryption system configured to receive electronic ballots from said 
voting device and to decrypt said encrypted electronic ballots; including said linking 
information; and a voting verification system Configured to receive decrypted voter 
selection data and linking information from said vote decryption system, to receive 
voter selection data and linking information from said printed ballots and to compare 
voters choices for a sample of said printed and electronic ballots linked by said linking 
information, to verify the voting. 

Figure 3 
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